Kimsuky (APT43) Dot-Padded LNK Spear-Phishing Tradecraft: Detection and Exploitation Analysis

Key facts for Kimsuky dot-padded LNK phishing

Detection coverage for Kimsuky dot-padded LNK phishing

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5175 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Kimsuky LNK Lure Chain - Hidden PowerShell, WScript JS and MSHTA HTA Execution

Behaviour-first detection of the Kimsuky (APT43) execution chain in TL-2026-5175: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass running a .ps1 (capture.Ps1), wscript/cscript running JScript/VBScript (DefenderUpdate.Js), mshta.exe running an HTA (D.21_SEOUL.hta) from user-writable folders, and the 100+ space argument padding used by Operation GitPower LNK lures. Known emulation lure names are flagged directly.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1059.001, T1059.005, T1059.007, T1218.005, T1564.003, T1027
• Data sources: sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1, DeviceProcessEvents, windows process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (OriginalFileName="wscript.exe" OR OriginalFileName="cscript.exe" OR OriginalFileName="MSHTA.EXE" OR OriginalFileName="PowerShell.EXE" OR OriginalFileName="Cmd.Exe")
| eval cl=lower(CommandLine), orig=lower(OriginalFileName)
| eval user_writable=if(match(cl,"(public|temp|appdata|downloads|programdata)"),1,0)
| eval ps_hidden_bypass=if(orig="powershell.exe" AND match(cl,"-w(indowstyle)?[ ]+hidden") AND match(cl,"-ex(ecutionpolicy)?[ ]+bypass") AND match(cl,"[.]ps1"),1,0)
| eval wsh_script=if(like(orig,"%script.exe") AND match(cl,"[.](js|jse|vbs|vbe)"),1,0)
| eval mshta_hta=if(orig="mshta.exe" AND match(cl,"[.]hta"),1,0)
| eval pad_args=if(match(cl,"[ ]{100,}"),1,0)
| eval known_lure=if(match(cl,"(defenderupdate[.]js|capture[.]ps1|d[.]21_seoul[.]hta|vvn[.]31[.]pdf)"),1,0)
| where known_lure=1 OR pad_args=1 OR (user_writable=1 AND (ps_hidden_bypass=1 OR wsh_script=1 OR mshta_hta=1))
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images max(known_lure) as known_lure by host User orig
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('wscript.exe','cscript.exe','mshta.exe','powershell.exe','pwsh.exe','cmd.exe')
| extend cl = tolower(ProcessCommandLine)
| extend UserWritable = cl has_any ('public','temp','appdata','downloads','programdata')
| extend PsHiddenBypass = FileName in~ ('powershell.exe','pwsh.exe') and cl matches regex @'-w(indowstyle)?[ ]+hidden' and cl matches regex @'-ex(ecutionpolicy)?[ ]+bypass' and cl contains '.ps1'
| extend WshScript = FileName in~ ('wscript.exe','cscript.exe') and cl matches regex @'[.](js|jse|vbs|vbe)'
| extend MshtaHta = FileName =~ 'mshta.exe' and cl contains '.hta'
| extend PadArgs = cl matches regex @'[ ]{100,}'
| extend KnownLure = cl matches regex @'(defenderupdate[.]js|capture[.]ps1|d[.]21_seoul[.]hta|vvn[.]31[.]pdf)'
| where KnownLure or PadArgs or (UserWritable and (PsHiddenBypass or WshScript or MshtaHta))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, PsHiddenBypass, WshScript, MshtaHta, PadArgs, KnownLure

Sigma

title: Kimsuky LNK Lure Chain - Hidden PowerShell, WScript and MSHTA from User-Writable Paths
id: 7c1e4b2a-3f5d-4a8e-9b61-2d0f8a5c1e01
status: experimental
description: Detects Kimsuky (APT43) execution tradecraft from TL-2026-5175 - hidden PowerShell with ExecutionPolicy Bypass running a ps1, wscript or cscript running JScript or VBScript, and mshta running an HTA from user-writable folders, plus 100 or more space argument padding used by Operation GitPower LNK lures.
references:
  - https://socprime.com/blog/kimsuky-detection-and-exploitation-analysis/
  - https://genians.co.kr/en/blog/threat_intelligence/ai-agent-opencode
  - https://www.fortinet.com/blog/threat-research/dprk-related-campaigns-with-lnk-and-github-c2
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1059.005
  - attack.t1059.007
  - attack.defense-evasion
  - attack.t1218.005
  - attack.t1564.003
  - attack.t1027
  - attack.g0094
logsource:
  category: process_creation
  product: windows
detection:
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - 'ExecutionPolicy'
      - 'Bypass'
      - 'Hidden'
      - '.ps1'
  selection_wsh:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|re: '(?i)\.(js|jse|vbs|vbe)\b'
  selection_mshta:
    Image|endswith: '\mshta.exe'
    CommandLine|contains: '.hta'
  selection_pad:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|re: '\s{100,}'
  selection_lure:
    CommandLine|contains:
      - 'DefenderUpdate.Js'
      - 'capture.Ps1'
      - 'D.21_SEOUL.hta'
      - 'vvn.31.Pdf'
  path_user_writable:
    CommandLine|contains:
      - '\Users\Public\'
      - '\AppData\'
      - '\Temp\'
      - '\Downloads\'
      - '\ProgramData\'
  condition: selection_lure or selection_pad or ((selection_ps or selection_wsh or selection_mshta) and path_user_writable)
falsepositives:
  - Administrative PowerShell deployment scripts run hidden from a Temp or ProgramData staging folder
  - Legacy logon scripts using wscript from a user profile
level: high

Known false positives:

• Administrative PowerShell deployment scripts launched hidden with ExecutionPolicy Bypass from a Temp or ProgramData staging folder
• Legacy WSH logon scripts (JScript/VBScript) run from user profile or Downloads folders
• Software installers that use mshta.exe to render an HTA setup UI from %TEMP%

Tuning notes: Adjust index/sourcetype to your Sysmon ingestion. Schedule every 15 minutes over a 24h lookback. Allowlist signed deployment tooling by ParentImage or User (SCCM, Intune, backup agents). The known_lure names come from the TL-2026-5175 emulation sample and are easy for the actor to change, so keep the behavioural clauses (hidden+bypass, WSH/HTA from user-writable paths, 100+ space padding) as the primary logic. Lower the pad_args threshold only after reviewing baseline noise.

• 🔒 Kimsuky Dot-Padded and Double-Extension LNK Lure File Creation · unlock with TL Creds
• 🔒 Kimsuky Built-in Administrator Activation, Rogue Account Creation and Hidden Logon Account · unlock with TL Creds
• 🔒 Kimsuky Community-Observed C2 Infrastructure and Known GitHub/Pastebin C2 URLs · unlock with TL Creds
• 🔒 Kimsuky Script Host Spawning Hidden PowerShell or Command Shell · unlock with TL Creds
• 🔒 Security Event Log Cleared (Event ID 1102) - Kimsuky Defense Evasion · unlock with TL Creds
• 🔒 System Process Name Executing from Non-System Path - Kimsuky smss.exe Masquerade · unlock with TL Creds
• 🔒 Kimsuky Service and Logon Scheduled Task Persistence Launching Hidden PowerShell · unlock with TL Creds
• 🔒 Kimsuky GitHub and Pastebin Staging/C2 from Script Interpreters · unlock with TL Creds

Indicators of compromise for Kimsuky dot-padded LNK phishing

As of 2026-11-03, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-5175.

Sample indicators (3 of 20)

• Domain: raw[.]githubusercontent[.]com
• URL: hxxps://pastebin[.]com/raw/gybpx38s
• File hash: af0309aa38d067373c54b2a7774a32f68ab72cb2dbf5aed74ac784b079830184

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

Community OSINT corroboration for Kimsuky dot-padded LNK phishing

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Kimsuky dot-padded LNK phishing works

Kimsuky (APT43, MITRE G0094; also Velvet Chollima, Black Banshee, THALLIUM, Emerald Sleet, TA427, Springtail) is a North Korean state-sponsored group assessed as aligned with the Reconnaissance General Bureau and operational since at least 2012 per CISA. Its primary targets are South Korea, with additional targeting of the US, Japan, Europe and Russia across government, diplomacy, academia and cryptocurrency sectors. Spear-phishing with LNK shortcut lures is its dominant entry method.

The SOC Prime analysis (2026-11-03) examines a controlled emulation of Kimsuky tradecraft run on 2026-09-21 against domain controller srv-ad-001.7logs.xyz (3,087 events over about three minutes, 15:02:41-15:05:58 UTC). It is NOT a confirmed live intrusion, and the file, service, task and account names below come from the emulation sample, not confirmed in-the-wild artifacts. The emulated chain begins with an LNK posing as a PDF whose name is padded with dots (vvn.31.Pdf......Lnk) in C:\Users\Public\Downloads. Execution proceeds through wscript.exe running DefenderUpdate.Js, powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File capture.Ps1, and mshta.exe running %TEMP%\D.21_SEOUL.hta. A binary masquerading as a system process (Public\Downloads\system32\smss.Exe) is staged from a user-writable path.

Persistence is established through a service named OrbitalTestSvc that launches hidden PowerShell via COMSPEC, and a logon-triggered scheduled task \OrbitalHealthCheck that runs svc_update.ps1 hidden. Account manipulation includes creating the account adminuserz and the group admingroupz, activating the built-in Administrator with net user administrator /active:yes, and hiding it from the logon screen via the Winlogon\SpecialAccounts\UserList registry path. Defense evasion ends with clearing the Security event log (Event ID 1102 at 15:02:41 UTC). The source reports that detection content matched 73 rules, with 9 attack chains identified.

Real-world 2026 Kimsuky activity corroborates the same tradecraft. Genians (report dated 2026-09-07) tracks Operation GitPower: ZIP-delivered LNK files that start obfuscated PowerShell, with about 300 leading spaces concealing arguments, 319 KB to 8.9 MB file-size padding, a custom decoder, hidden scheduled tasks impersonating BitLocker, MATLAB and .NET NGEN components, and GitHub raw-content staging and C2 using hard-coded personal access tokens, with Pastebin as an alternate channel. Fortinet FortiGuard (2026-04-02) documented a related LNK/GitHub C2 chain tied to the GitHub account motoralis, with a 30-minute VBScript scheduled task, anti-analysis checks for 30+ analysis tools, and exfiltration to GitHub. The SOC Prime article also notes an October expansion of GitPower with fake Zoom installers and a March-April HTTPSpy variant using spoofed security-software pages and fake Cisco Webex.

Caveats: no CVEs, no affected product versions and no CVSS apply. Severity is analyst-assigned. The SOC Prime ATT&CK list is labelled inferred and contains some mislabelled IDs, which were corrected here to the actual techniques observed.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1218.005 Mshta; T1497 Virtualization/Sandbox Evasion; T1564.002 Hidden Users; T1564.003 Hidden Window

Persistence

T1053.005 Scheduled Task; T1136.002 Domain Account; T1543.003 Windows Service

Execution

T1059.001 PowerShell; T1059.005 Visual Basic; T1059.007 JavaScript; T1204.002 Malicious File

Privilege Escalation

T1078.001 Default Accounts

defense-impairment

T1112 Modify Registry; T1685.005 Clear Windows Event Logs

Initial Access

T1566.001 Spearphishing Attachment

Remediation for Kimsuky dot-padded LNK phishing

Immediate actions

• Isolate affected host; image memory and disk before remediation
• Verify and remove scheduled task \OrbitalHealthCheck and service OrbitalTestSvc if present
• Verify removal of accounts adminuserz and group admingroupz; revert Winlogon\SpecialAccounts\UserList
• Reset Administrator password and perform a double krbtgt reset on domain controllers
• Collect and hash contents of C:\Users\Public\Downloads and %TEMP%; start timeline analysis at Event ID 1102
• Hunt domain-wide for dot-padded LNK files and script hosts launched from user-writable folders

Workarounds

• Block or open-in-editor LNK files in ZIP archives at the mail gateway
• Restore audit policy if tampered (Event ID 4719)

Longer-term hardening

• Maintain Event ID 4688 process creation logging with full command lines
• Enable PowerShell Script Block Logging and AMSI telemetry
• Alert on 4697 service installs and 4698 task creations launching hidden PowerShell
• Treat any Event ID 1102 on a domain controller as an incident trigger
• Restrict WScript, CScript, mshta and PowerShell via application allowlisting
• Monitor and restrict outbound access to GitHub raw/API and Pastebin from non-developer endpoints

Affected and fixed versions

• Microsoft — Windows (LNK, PowerShell, WScript, MSHTA, Task Scheduler, Service Control Manager)
  Vulnerable versions: Behavior-based abuse of built-in features; no specific version stated in sources

Timeline of Kimsuky dot-padded LNK phishing

• 2012-01-01 Kimsuky assessed by CISA as operational since 2012 (year only stated in source; date normalized to January 1).
• 2013-01-01 First detailed public report, 'The Kimsuky Operation' by Kaspersky (year only stated in source; date normalized to January 1).
• 2026-04-02 Fortinet FortiGuard publishes DPRK-related LNK and GitHub C2 campaign tied to GitHub account locked-ioc-20.
• 2026-08-11 Genians begins collecting Operation GitPower LNK samples (Aug 11-19, 2026), including Korean-language finance/insurance lures.
• 2026-08-16 Batch-generated decoy PDFs with identical 2026-08-16 03:00:00 UTC timestamps and opencode metadata observed by Genians.
• 2026-09-07 Genians publishes analysis of Kimsuky GitHub PAT-backed LNK campaign (Operation GitPower).
• 2026-09-21 Kimsuky tradecraft emulation run against domain controller srv-ad-001.7logs.xyz; Security log cleared (Event ID 1102) at 15:02:41 UTC, activity ends 15:05:58 UTC.
• 2026-11-03 SOC Prime publishes detection and exploitation analysis of the emulated Kimsuky chain.

Sources cited for Kimsuky dot-padded LNK phishing

• Kimsuky OpenCode / Operation GitPower analysis (Genians) genians.co.kr · Research · 2026-09-07
• DPRK-Related Campaigns with LNK and GitHub C2 (Fortinet FortiGuard Labs) Fortinet · Vendor report · 2026-04-02
• MITRE ATT&CK Group G0094 - Kimsuky MITRE · Research
• Kimsuky Detection and Exploitation Analysis (SOC Prime) socprime.com · Blog · 2026-11-03
• Malicious LNK Files Distributing a Python-Based Backdoor (Kimsuky) - SOC Prime socprime.com · Blog
• Phishing to persistence: The full lifecycle of Kimsuky's attack chain (ManageEngine) manageengine.com · Blog
• DPRK-Linked Hackers Use GitHub as C2 (The Hacker News) The Hacker News · News · 2026-04-02

More in apt

• APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)
• Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088)
• ARTEX Agentic AI Penetration-Testing Framework Abused by China-Aligned Actors Storm-0940 and VAPOR PANDA to Automate Enterprise and Cloud Intrusions
• TraderTraitor (North Korea) months-long campaign leads to $6.34B Binance cryptocurrency theft
• AI agent frameworks ARTEX (Vapor Panda, Storm-0940) and CyberStrikeAI scale China-linked intrusion campaigns