# Kimsuky-Linked Funhouse Ransomware (Endpoint Ransomware Variant) Distributed via Malicious Hangul Resume Documents and Quasar RAT

> AhnLab ASEC reports Kimsuky-linked distribution of Funhouse ransomware, an evolution of the previously disclosed Endpoint ransomware, via weaponized HWP resume documents. The multi-stage chain (Batch, VBS, PowerShell) uses a Quasar RAT injected into msbuild.exe as an intermediate stage before RuntimeBroker.exe runs the ransomware, and marks a shift from LNK files to HWP as the initial vector.

- **Published:** 2026-10-12T08:35:48Z
- **Last reviewed:** 2026-10-12T08:35:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3335
- **ID:** TL-2026-3335
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Kimsuky (North Korea)
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ASEC (AhnLab Security Intelligence Center) published on 2026-10-01 an analysis of Funhouse ransomware, a variant of the Endpoint ransomware family that ASEC previously disclosed in cases dated February and June 2026. The campaign is attributed to the Kimsuky group (North Korea-linked) on the basis of the multi-stage attack flow, reuse of the VbsEdit-based executor (pdf.Exe) seen in earlier Kimsuky malware distribution, batch script code similar to scripts in previously reported Kimsuky Python-backdoor cases, and a Quasar RAT variant using the same mutex (_QQ_XCZ_VCXZ) across all documented cases.

Initial access is a malicious Hangul (HWP) document disguised as a resume (Resume.Hwp) with embedded OLE data, replacing the malicious LNK files used in earlier Kimsuky cases. Opening the document drops pdf.Exe (a VbsEdit script executor) and pdf.Exe.Manifest in %TEMP%; a hyperlink to resume_{name}.Pdf in the document triggers pdf.Exe, which creates a randomly named lpe{random}.Bat (e.g. lpe_75285.Bat). Batch files (lpe_75285.Bat, b7a093f.Bat) download further payloads from several compromised or attacker-controlled web servers (dl.Zip containing ch.Bat and poef0od.Vbs; ch.Bat acts as an update mechanism). VBS and PowerShell scripts (uac41.Ps1) perform a UAC bypass. A scheduled task runs 1.Vbs, which executes C:\Themes\fox.Ps1; fox.Ps1 loads 1s5t45.Bmp, which injects 2serges.Bmp (Quasar RAT, embedded in a BMP-named container) into msbuild.exe. The Quasar RAT reads its configuration (C2 address, TAG, mutex) from a file with a .DWG extension (dog.Dwg in this case, v4.4.3, C2 70.36.97.236:443, TAG format {Company Name}_it1; earlier cases used se.Dwg, v1.1.8, C2 45.43.60.53:80 and 45.95.186.232:80). RuntimeBroker.exe then executes the Funhouse ransomware payload.

Funhouse encrypts files with the extension .Funhouse using HC-128, with key generation based on CryptGenRandom, Curve25519 and SHA-512. A 72-byte footer containing the marker string 'Choung Dong looks like a hot dog!!' is appended, the ransom note is 'How To Restore Your Files.Txt', and the mutex is DoYouWantToHaveSexWithCuongDong. The current variant lists funhouse8764@tutamail.com as the contact. The February 2026 Endpoint variant used the .Endpoint extension, ChaCha20, a 1,592-byte footer, the mutex Mutexisfunnylocal, SHA-256-based key generation and the contact schipkealfred@gmail.com; the June 2026 variant already used HC-128, .Funhouse and funhouseraas@proton.me. Encryption characteristics were retained after June while contact details and C2 infrastructure changed. No CVE or CVSS score is stated in the source; the lure relies on user execution of the malicious document.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1548.002 Bypass User Account Control
- T1055 Process Injection
- T1127.001 MSBuild
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1219 Remote Access Tools
- T1071.001 Web Protocols

## Sources

- [From Endpoint to Funhouse: Evolution of Ransomware Families and Kimsuky-Linked Distribution Cases](https://asec.ahnlab.com/en/95775/)
- [Malicious LNK Files Distributing a Python-Based Backdoor and Changes in Distribution Techniques (Kimsuky Group) - ASEC](https://asec.ahnlab.com/en/tag/backdoor-en)
- [Kimsuky Deploys Malicious LNK Files - Cyber Security News](https://cybersecuritynews.com/kimsuky-deploys-malicious-lnk-files/amp/)
- [April 2026 Threat Trend Report on APT Attacks (South Korea) - ASEC](https://asec.ahnlab.com/en/tag/%EB%B0%B1%EB%8F%84%EC%96%B4-en/)
- [Kimsuky Group Adds New Tool Into Play - Cyware](https://social.cyware.com/news/kimsuky-group-adds-new-tool-into-play-39c2742d)
- [ASEC Kimsuky tag archive](https://asec.ahnlab.com/en/tag/kimsuky-en/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3335