Kimsuky’s LNK-based attack chain now includes multiple stages (XML, VBS, PS1, BAT) before deploying a Python backdoor via ZIP fragments and Task Scheduler. Uses Dropbox and custom C2 for data exfiltration. #Kimsuky #PythonBackdoor #SouthKorea
A malicious LNK that spreads a Python-based backdoor and how it’s spreading (Kimsuky group)
The ASEC analysis describes how Kimsuky modified its LNK-based distribution chain to add multiple intermediate stages (XML, VBS, PS1, BAT) while retaining a final Python backdoor or downloader delivered via ZIP fragments and Task Scheduler registrations. The campaign uses cloud services (Dropbox) and a custom C2 protocol to exfiltrate system information...
www.hendryadrian.com
April 2, 2026 at 5:00 AM
Kimsuky’s LNK-based attack chain now includes multiple stages (XML, VBS, PS1, BAT) before deploying a Python backdoor via ZIP fragments and Task Scheduler. Uses Dropbox and custom C2 for data exfiltration. #Kimsuky #PythonBackdoor #SouthKorea
New Python Backdoor Uses Tunneling Service to Steal Browser and Cloud Credentials reconbee.com/new-python-b...
#PythonBackdoor #stealbrowser #cloudcredentials #cyberattack
#PythonBackdoor #stealbrowser #cloudcredentials #cyberattack
New Python Backdoor Uses Tunneling Service to Steal Browser and Cloud Credentials
effective are presently unknown read more about New Python Backdoor Uses Tunneling Service to Steal Browser and Cloud Credentials
reconbee.com
May 1, 2026 at 6:59 AM
New Python Backdoor Uses Tunneling Service to Steal Browser and Cloud Credentials reconbee.com/new-python-b...
#PythonBackdoor #stealbrowser #cloudcredentials #cyberattack
#PythonBackdoor #stealbrowser #cloudcredentials #cyberattack