Kimsuky phishing attacks target Japan and South Korea
Kimsuky, a North Korea-linked hacking group, is running phishing campaigns against people in South Korea and Japan. Once a target opens a rigged file, the group reads their email, logs their keystrokes, and quietly takes remote control of their computer.
- Report priority
- Medium
- Targets
- Chrome Remote Desktop+5 more
How it works
- The attack starts with an email that links to a file archive on Microsoft OneDrive.
- Inside is a Windows shortcut disguised as a document, and opening it silently runs a hidden script that installs a backdoor and sets it to keep restarting itself every 15 minutes.
What to do
Check whether you received an unexpected OneDrive link containing a shortcut file posing as a document, and whether Windows Task Scheduler shows a task named Chrome_Update that you did not create.
Do not open unsolicited OneDrive links or shortcut file attachments, and if you find the Chrome_Update task, disconnect the machine from the network and have IT check for Chrome Remote Desktop or AnyDesk sessions you did not set up.
Technical details
Affected software: Chrome Remote Desktop, AnyDesk, Mozilla Thunderbird, Microsoft Outlook, Gmail, Windows
A policy researcher in South Korea or Japan opens an email with a link to a document archive on OneDrive. Inside is a shortcut file disguised as a report on regional affairs; opening it quietly shows a decoy document while installing a hidden VBScript backdoor called bot.vbe. The backdoor creates a scheduled task named Chrome_Update to keep contacting the attackers' servers, then pulls in tools that copy the victim's Outlook and Thunderbird email and log every keystroke.
The infection chain uses an LNK file to run an embedded command that drops a decoy document and an obfuscated VBScript (bot.vbe), persisted via a scheduled task named Chrome_Update that beacons to command-and-control infrastructure every 15 minutes. Follow-on PowerShell scripts fingerprint installed security software, exfiltrate Thunderbird mailbox files and Outlook mail since January 2026, and a custom C keylogger (namespace Masakoyoji.Komori) records keystrokes locally. For persistence, the actor installs Chrome Remote Desktop via the fodhelper.exe UAC-bypass technique, binding it to an attacker-controlled Google account, and installs AnyDesk with its window, taskbar icon, and tray icon hidden. A custom Chrome extension also scrapes Gmail webmail content for exfiltration.