# Kimsuky (APT43) Dot-Padded LNK Spear-Phishing Tradecraft: Detection and Exploitation Analysis

> SOC Prime analyzes a controlled emulation of Kimsuky tradecraft against a domain controller: dot-padded LNK files posing as documents, hidden PowerShell/WScript/MSHTA execution, service and logon-triggered scheduled-task persistence, hidden account creation, and Security audit log clearing. Kimsuky is a North Korean state-sponsored group believed aligned with the Reconnaissance General Bureau, targeting government, policy, academic, and cryptocurrency sectors.

- **Published:** 2026-11-03T20:33:10Z
- **Last reviewed:** 2026-11-03T20:33:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5175
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5175.png
- **ID:** TL-2026-5175
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Kimsuky (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

Kimsuky (APT43, MITRE G0094; also Velvet Chollima, Black Banshee, THALLIUM, Emerald Sleet, TA427, Springtail) is a North Korean state-sponsored group assessed as aligned with the Reconnaissance General Bureau and operational since at least 2012 per CISA. Its primary targets are South Korea, with additional targeting of the US, Japan, Europe and Russia across government, diplomacy, academia and cryptocurrency sectors. Spear-phishing with LNK shortcut lures is its dominant entry method.

The SOC Prime analysis (2026-11-03) examines a controlled emulation of Kimsuky tradecraft run on 2026-09-21 against domain controller srv-ad-001.7logs.xyz (3,087 events over about three minutes, 15:02:41-15:05:58 UTC). It is NOT a confirmed live intrusion, and the file, service, task and account names below come from the emulation sample, not confirmed in-the-wild artifacts. The emulated chain begins with an LNK posing as a PDF whose name is padded with dots (vvn.31.Pdf......Lnk) in C:\Users\Public\Downloads. Execution proceeds through wscript.exe running DefenderUpdate.Js, powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File capture.Ps1, and mshta.exe running %TEMP%\D.21_SEOUL.hta. A binary masquerading as a system process (Public\Downloads\system32\smss.Exe) is staged from a user-writable path.

Persistence is established through a service named OrbitalTestSvc that launches hidden PowerShell via COMSPEC, and a logon-triggered scheduled task \OrbitalHealthCheck that runs svc_update.ps1 hidden. Account manipulation includes creating the account adminuserz and the group admingroupz, activating the built-in Administrator with net user administrator /active:yes, and hiding it from the logon screen via the Winlogon\SpecialAccounts\UserList registry path. Defense evasion ends with clearing the Security event log (Event ID 1102 at 15:02:41 UTC). The source reports that detection content matched 73 rules, with 9 attack chains identified.

Real-world 2026 Kimsuky activity corroborates the same tradecraft. Genians (report dated 2026-09-07) tracks Operation GitPower: ZIP-delivered LNK files that start obfuscated PowerShell, with about 300 leading spaces concealing arguments, 319 KB to 8.9 MB file-size padding, a custom decoder, hidden scheduled tasks impersonating BitLocker, MATLAB and .NET NGEN components, and GitHub raw-content staging and C2 using hard-coded personal access tokens, with Pastebin as an alternate channel. Fortinet FortiGuard (2026-04-02) documented a related LNK/GitHub C2 chain tied to the GitHub account motoralis, with a 30-minute VBScript scheduled task, anti-analysis checks for 30+ analysis tools, and exfiltration to GitHub. The SOC Prime article also notes an October expansion of GitPower with fake Zoom installers and a March-April HTTPSpy variant using spoofed security-software pages and fake Cisco Webex.

Caveats: no CVEs, no affected product versions and no CVSS apply. Severity is analyst-assigned. The SOC Prime ATT&CK list is labelled inferred and contains some mislabelled IDs, which were corrected here to the actual techniques observed.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1053.005 Scheduled Task
- T1543.003 Windows Service
- T1136.002 Domain Account
- T1218.005 Mshta
- T1036.005 Match Legitimate Resource Name or Location
- T1685.005 Clear Windows Event Logs
- T1564.003 Hidden Window
- T1564.002 Hidden Users
- T1112 Modify Registry
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1078.001 Default Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Kimsuky LNK Lure Chain - Hidden PowerShell, WScript JS and MSHTA HTA Execution** (`TL-2026-5175-SPL-001`)

Behaviour-first detection of the Kimsuky (APT43) execution chain in TL-2026-5175: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass running a .ps1 (capture.Ps1), wscript/cscript running JScript/VBScript (DefenderUpdate.Js), mshta.exe running an HTA (D.21_SEOUL.hta) from user-writable folders, and the 100+ space argument padding used by Operation GitPower LNK lures. Known emulation lure names are flagged directly.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1059.001, T1059.005, T1059.007, T1218.005, T1564.003, T1027
- **Data sources:** sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1, DeviceProcessEvents, windows process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (OriginalFileName="wscript.exe" OR OriginalFileName="cscript.exe" OR OriginalFileName="MSHTA.EXE" OR OriginalFileName="PowerShell.EXE" OR OriginalFileName="Cmd.Exe")
| eval cl=lower(CommandLine), orig=lower(OriginalFileName)
| eval user_writable=if(match(cl,"(public|temp|appdata|downloads|programdata)"),1,0)
| eval ps_hidden_bypass=if(orig="powershell.exe" AND match(cl,"-w(indowstyle)?[ ]+hidden") AND match(cl,"-ex(ecutionpolicy)?[ ]+bypass") AND match(cl,"[.]ps1"),1,0)
| eval wsh_script=if(like(orig,"%script.exe") AND match(cl,"[.](js|jse|vbs|vbe)"),1,0)
| eval mshta_hta=if(orig="mshta.exe" AND match(cl,"[.]hta"),1,0)
| eval pad_args=if(match(cl,"[ ]{100,}"),1,0)
| eval known_lure=if(match(cl,"(defenderupdate[.]js|capture[.]ps1|d[.]21_seoul[.]hta|vvn[.]31[.]pdf)"),1,0)
| where known_lure=1 OR pad_args=1 OR (user_writable=1 AND (ps_hidden_bypass=1 OR wsh_script=1 OR mshta_hta=1))
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images max(known_lure) as known_lure by host User orig
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('wscript.exe','cscript.exe','mshta.exe','powershell.exe','pwsh.exe','cmd.exe')
| extend cl = tolower(ProcessCommandLine)
| extend UserWritable = cl has_any ('public','temp','appdata','downloads','programdata')
| extend PsHiddenBypass = FileName in~ ('powershell.exe','pwsh.exe') and cl matches regex @'-w(indowstyle)?[ ]+hidden' and cl matches regex @'-ex(ecutionpolicy)?[ ]+bypass' and cl contains '.ps1'
| extend WshScript = FileName in~ ('wscript.exe','cscript.exe') and cl matches regex @'[.](js|jse|vbs|vbe)'
| extend MshtaHta = FileName =~ 'mshta.exe' and cl contains '.hta'
| extend PadArgs = cl matches regex @'[ ]{100,}'
| extend KnownLure = cl matches regex @'(defenderupdate[.]js|capture[.]ps1|d[.]21_seoul[.]hta|vvn[.]31[.]pdf)'
| where KnownLure or PadArgs or (UserWritable and (PsHiddenBypass or WshScript or MshtaHta))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, PsHiddenBypass, WshScript, MshtaHta, PadArgs, KnownLure
```

### Sigma

```yaml
title: Kimsuky LNK Lure Chain - Hidden PowerShell, WScript and MSHTA from User-Writable Paths
id: 7c1e4b2a-3f5d-4a8e-9b61-2d0f8a5c1e01
status: experimental
description: Detects Kimsuky (APT43) execution tradecraft from TL-2026-5175 - hidden PowerShell with ExecutionPolicy Bypass running a ps1, wscript or cscript running JScript or VBScript, and mshta running an HTA from user-writable folders, plus 100 or more space argument padding used by Operation GitPower LNK lures.
references:
  - https://socprime.com/blog/kimsuky-detection-and-exploitation-analysis/
  - https://genians.co.kr/en/blog/threat_intelligence/ai-agent-opencode
  - https://www.fortinet.com/blog/threat-research/dprk-related-campaigns-with-lnk-and-github-c2
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1059.005
  - attack.t1059.007
  - attack.defense-evasion
  - attack.t1218.005
  - attack.t1564.003
  - attack.t1027
  - attack.g0094
logsource:
  category: process_creation
  product: windows
detection:
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - 'ExecutionPolicy'
      - 'Bypass'
      - 'Hidden'
      - '.ps1'
  selection_wsh:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|re: '(?i)\.(js|jse|vbs|vbe)\b'
  selection_mshta:
    Image|endswith: '\mshta.exe'
    CommandLine|contains: '.hta'
  selection_pad:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|re: '\s{100,}'
  selection_lure:
    CommandLine|contains:
      - 'DefenderUpdate.Js'
      - 'capture.Ps1'
      - 'D.21_SEOUL.hta'
      - 'vvn.31.Pdf'
  path_user_writable:
    CommandLine|contains:
      - '\Users\Public\'
      - '\AppData\'
      - '\Temp\'
      - '\Downloads\'
      - '\ProgramData\'
  condition: selection_lure or selection_pad or ((selection_ps or selection_wsh or selection_mshta) and path_user_writable)
falsepositives:
  - Administrative PowerShell deployment scripts run hidden from a Temp or ProgramData staging folder
  - Legacy logon scripts using wscript from a user profile
level: high
```

**Known false positives:**

- Administrative PowerShell deployment scripts launched hidden with ExecutionPolicy Bypass from a Temp or ProgramData staging folder
- Legacy WSH logon scripts (JScript/VBScript) run from user profile or Downloads folders
- Software installers that use mshta.exe to render an HTA setup UI from %TEMP%

**Tuning notes:** Adjust index/sourcetype to your Sysmon ingestion. Schedule every 15 minutes over a 24h lookback. Allowlist signed deployment tooling by ParentImage or User (SCCM, Intune, backup agents). The known_lure names come from the TL-2026-5175 emulation sample and are easy for the actor to change, so keep the behavioural clauses (hidden+bypass, WSH/HTA from user-writable paths, 100+ space padding) as the primary logic. Lower the pad_args threshold only after reviewing baseline noise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Kimsuky Dot-Padded and Double-Extension LNK Lure File Creation (locked: unlock with TL Creds)
- Kimsuky Built-in Administrator Activation, Rogue Account Creation and Hidden Logon Account (locked: unlock with TL Creds)
- Kimsuky Community-Observed C2 Infrastructure and Known GitHub/Pastebin C2 URLs (locked: unlock with TL Creds)
- Kimsuky Script Host Spawning Hidden PowerShell or Command Shell (locked: unlock with TL Creds)
- Security Event Log Cleared (Event ID 1102) - Kimsuky Defense Evasion (locked: unlock with TL Creds)
- System Process Name Executing from Non-System Path - Kimsuky smss.exe Masquerade (locked: unlock with TL Creds)
- Kimsuky Service and Logon Scheduled Task Persistence Launching Hidden PowerShell (locked: unlock with TL Creds)
- Kimsuky GitHub and Pastebin Staging/C2 from Script Interpreters (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- Domain: `raw[.]githubusercontent[.]com`
- URL: `hxxps://pastebin[.]com/raw/gybpx38s`
- File hash: `af0309aa38d067373c54b2a7774a32f68ab72cb2dbf5aed74ac784b079830184`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Kimsuky Detection and Exploitation Analysis (SOC Prime)](https://socprime.com/blog/kimsuky-detection-and-exploitation-analysis/)
- [Kimsuky OpenCode / Operation GitPower analysis (Genians)](https://genians.co.kr/en/blog/threat_intelligence/ai-agent-opencode)
- [DPRK-Related Campaigns with LNK and GitHub C2 (Fortinet FortiGuard Labs)](https://www.fortinet.com/blog/threat-research/dprk-related-campaigns-with-lnk-and-github-c2)
- [DPRK-Linked Hackers Use GitHub as C2 (The Hacker News)](https://thehackernews.com/2026/04/dprk-linked-hackers-use-github-as-c2-in.html)
- [Malicious LNK Files Distributing a Python-Based Backdoor (Kimsuky) - SOC Prime](https://socprime.com/active-threats/malicious-lnk-files-distributing-a-python-based-backdoor-and-changes-in-distribution-techniques-kimsuky-group/)
- [Phishing to persistence: The full lifecycle of Kimsuky's attack chain (ManageEngine)](https://www.manageengine.com/log-management/cyber-security/kimsuky-north-korean-hackers-apt43.html)
- [MITRE ATT&CK Group G0094 - Kimsuky](https://attack.mitre.org/groups/G0094/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5175