Threat reportRansomwareTL-2026-3335
Kimsuky-Linked Funhouse Ransomware (Endpoint Ransomware Variant) Distributed via Malicious Hangul Resume Documents and Quasar RAT
Kimsuky-Linked Funhouse Ransomware (Endpoint Ransomware (TL-2026-3335), also tracked as Funhouse ransomware, is a high-severity ransomware operation, first published 2026-10-12. It is attributed to Kimsuky (North Korea) with medium confidence, affects Microsoft Windows, maps to 13 MITRE ATT&CK techniques (T1027, T1036.005, T1053.005), and is covered by 9 detection rules and 37 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 1Kimsuky
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 37Indicators of compromise
Key facts for TL-2026-3335
- Threat ID
- TL-2026-3335
- Also known as
- Funhouse ransomware, Endpoint ransomware
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Kimsuky
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- general, corporate
- Target regions
- south korea
- Detection rules
- 9
- Indicators of compromise
- 37
Malware and tooling in Kimsuky-Linked Funhouse Ransomware (Endpoint Ransomware
Malware and tooling: Funhouse ransomware, Quasar RAT, xRAT, Quasar RAT
How Kimsuky-Linked Funhouse Ransomware (Endpoint Ransomware works
AhnLab ASEC reports Kimsuky-linked distribution of Funhouse ransomware, an evolution of the previously disclosed Endpoint ransomware, via weaponized HWP resume documents. The multi-stage chain (Batch, VBS, PowerShell) uses a Quasar RAT injected into msbuild.exe as an intermediate stage before RuntimeBroker.exe runs the ransomware, and marks a shift from LNK files to HWP as the initial vector.
ASEC (AhnLab Security Intelligence Center) published on 2026-10-01 an analysis of Funhouse ransomware, a variant of the Endpoint ransomware family that ASEC previously disclosed in cases dated February and June 2026. The campaign is attributed to the Kimsuky group (North Korea-linked) on the basis of the multi-stage attack flow, reuse of the VbsEdit-based executor (pdf.Exe) seen in earlier Kimsuky malware distribution, batch script code similar to scripts in previously reported Kimsuky Python-backdoor cases, and a Quasar RAT variant using the same mutex (_QQ_XCZ_VCXZ) across all documented cases.
Initial access is a malicious Hangul (HWP) document disguised as a resume (Resume.Hwp) with embedded OLE data, replacing the malicious LNK files used in earlier Kimsuky cases. Opening the document drops pdf.Exe (a VbsEdit script executor) and pdf.Exe.Manifest in %TEMP%; a hyperlink to resume_{name}.Pdf in the document triggers pdf.Exe, which creates a randomly named lpe{random}.Bat (e.g. lpe_75285.Bat). Batch files (lpe_75285.Bat, b7a093f.Bat) download further payloads from several compromised or attacker-controlled web servers (dl.Zip containing ch.Bat and poef0od.Vbs; ch.Bat acts as an update mechanism). VBS and PowerShell scripts (uac41.Ps1) perform a UAC bypass. A scheduled task runs 1.Vbs, which executes C:\Themes\fox.Ps1; fox.Ps1 loads 1s5t45.Bmp, which injects 2serges.Bmp (Quasar RAT, embedded in a BMP-named container) into msbuild.exe. The Quasar RAT reads its configuration (C2 address, TAG, mutex) from a file with a .DWG extension (dog.Dwg in this case, v4.4.3, C2 70.36.97.236:443, TAG format {Company Name}_it1; earlier cases used se.Dwg, v1.1.8, C2 45.43.60.53:80 and 45.95.186.232:80). RuntimeBroker.exe then executes the Funhouse ransomware payload.
Funhouse encrypts files with the extension .Funhouse using HC-128, with key generation based on CryptGenRandom, Curve25519 and SHA-512. A 72-byte footer containing the marker string 'Choung Dong looks like a hot dog!!' is appended, the ransom note is 'How To Restore Your Files.Txt', and the mutex is DoYouWantToHaveSexWithCuongDong. The current variant lists funhouse8764@tutamail.com as the contact. The February 2026 Endpoint variant used the .Endpoint extension, ChaCha20, a 1,592-byte footer, the mutex Mutexisfunnylocal, SHA-256-based key generation and the contact schipkealfred@gmail.com; the June 2026 variant already used HC-128, .Funhouse and funhouseraas@proton.me. Encryption characteristics were retained after June while contact details and C2 infrastructure changed. No CVE or CVSS score is stated in the source; the lure relies on user execution of the malicious document.
MITRE ATT&CK techniques used in TL-2026-3335
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1127.001 MSBuild
Persistence
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools
Privilege Escalation
T1548.002 Bypass User Account Control
Initial Access
Affected products and versions in Kimsuky-Linked Funhouse Ransomware (Endpoint Ransomware
- Microsoft — Windows
Vulnerable versions: Windows endpoints opening malicious HWP documents (versions not specified in source) - Hancom — Hangul Word Processor (HWP)
Vulnerable versions: Not specified in source; lure format abused (embedded OLE object)
Remediation for Kimsuky-Linked Funhouse Ransomware (Endpoint Ransomware
Immediate actions
- Block the listed IPs, domains and URLs at the perimeter and proxy
- Hunt for Resume.Hwp, pdf.Exe, pdf.Exe.Manifest, lpe*.Bat, fox.Ps1 and C:\Themes\ artifacts on endpoints
- Hunt for .DWG-extension files read as Quasar RAT configuration and for the mutex _QQ_XCZ_VCXZ
- Isolate hosts where msbuild.exe runs outside a build context or makes outbound network connections
Workarounds
- Restrict execution of VBScript and Windows Script Host where not required
- Alert on scheduled-task creation that launches wscript/powershell from non-standard directories
Longer-term hardening
- Deploy EDR with behavioral detection for process injection into msbuild.exe and UAC bypass
- Restrict or sandbox HWP documents with embedded OLE objects from external email
- Maintain offline, tested backups to recover from file-encrypting ransomware
Timeline of Kimsuky-Linked Funhouse Ransomware (Endpoint Ransomware
- ASEC identifies the initial Endpoint ransomware variant in Kimsuky-related cases: .Endpoint extension, ChaCha20, 1,592-byte footer, mutex Mutexisfunnylocal, contact schipkealfred@gmail.com (month precision per ASEC).
- Earlier Kimsuky cases use Quasar RAT v1.1.8 configured via se.Dwg with C2 45.43.60.53:80 and 45.95.186.232:80 and mutex _QQ_XCZ_VCXZ (February/June 2026 cases; month precision, day set to avoid collision).
- Updated variant observed: switch to HC-128 with CryptGenRandom, Curve25519 and SHA-512 key generation, 72-byte footer with 'Choung Dong looks like a hot dog!!' marker, .Funhouse extension, contact funhouseraas@proton.me (month precision per ASEC).
- Funhouse variant distributed via malicious HWP resume documents (Resume.Hwp), replacing LNK as initial vector; contact changes to funhouse8764@tutamail.com (month precision per ASEC).
- Quasar RAT v4.4.3 configured via dog.Dwg with C2 70.36.97.236:443 in the Funhouse case, injected into msbuild.exe from 2serges.Bmp (September 2026 case; month precision, day set to avoid collision).
- AhnLab ASEC publishes 'From Endpoint to Funhouse' with IOCs and Kimsuky attribution analysis.
- BeaconBeagle lookup for C2 IP 70.36.97.236 returns HTTP 404 (no beacon record) during TL-2026-3335 research.
Sources cited for Kimsuky-Linked Funhouse Ransomware (Endpoint Ransomware
- From Endpoint to Funhouse: Evolution of Ransomware Families and Kimsuky-Linked Distribution Cases
- Malicious LNK Files Distributing a Python-Based Backdoor and Changes in Distribution Techniques (Kimsuky Group) - ASEC
- Kimsuky Deploys Malicious LNK Files - Cyber Security News
- April 2026 Threat Trend Report on APT Attacks (South Korea) - ASEC
- Kimsuky Group Adds New Tool Into Play - Cyware
- ASEC Kimsuky tag archive
Detection coverage for TL-2026-3335
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3335 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.