Kimsuky Deploys Funhouse Ransomware via Quasar RAT and Hangul Documents
Analysts link September 2026 Kimsuky activity to earlier campaigns, noting continuity in tactics despite changes in infrastructure and ransomware variants.
Key points
- The campaign uses malicious Hangul documents disguised as resumes to deliver Funhouse ransomware.
- A multi-stage infection chain includes OLE objects, scripts, a Python backdoor, and Quasar RAT.
- ASEC analysis links this activity to previous Endpoint ransomware deployments by the group.
The threat group Kimsuky delivered Funhouse ransomware to targets in September 2026 using a complex, multi-stage attack chain that began with a malicious Hangul document. According to GBHackers, the operation relies on a resume file that triggers a sequence of scripts and backdoors before deploying the final encryption payload.
The initial lure, named resume.hwp, contains embedded OLE objects that extract executable files into the Windows temporary directory without requiring further user interaction. However, GBHackers reports that this extraction alone does not start the full infection sequence. The document includes a hyperlink that appears to open a PDF resume, which actually launches a VBScript editor to process a malicious manifest script.
Attack Chain and Technical Details
Clicking the deceptive hyperlink executes pdf.exe, which processes the pdf.exe.manifest script to create a batch file in the temporary directory. This action initiates the next stage of the attack, establishing a clear distinction between passive file deposition and active execution triggered by user clicks.
Successive batch, VBS, and PowerShell scripts establish the persistent infection chain. These scripts deploy a Python backdoor and install Quasar RAT, a remote access trojan. The attackers then use Quasar RAT as the bridge to execute Funhouse ransomware, moving from initial compromise to data encryption through the remote access component.
Continuity with Previous Campaigns
ASEC, the agency that identified these details, connected the current executor and manifest pairing to earlier Kimsuky distribution cases. The analysis indicates continuity with previous operations rather than an entirely new ransomware effort, despite changes in delivery files and infrastructure.
Earlier Kimsuky campaigns distributed Endpoint ransomware using similar layered scripts and scheduled tasks. ASEC noted similarities between the current batch scripts and those used in previous LNK campaigns that distributed Python backdoors. The group repeatedly modifies intermediate execution stages while preserving its broader delivery architecture.
Infrastructure and Configuration Changes
The current Quasar RAT variant stores its configuration in a file named dog.dwg, replacing the se.dwg file observed in February and June. The configured VERSION value increased to 4.4.3 from 1.1.8, and the command and control endpoint changed to 70.36.97[.]236:443.
Despite these infrastructure updates, all three configuration versions retained the mutex _QQ_XCZ_VCXZ. This consistency in implementation details allows analysts to link the September 2026 activity to earlier campaigns attributed to Kimsuky, even as contact addresses and configuration versions evolve.
What should you do?
Security teams should monitor for unusual script executions and remote access tools following document interactions. That suggests focusing on behavioral indicators rather than static file hashes, given the group's history of modifying intermediate stages.
What to do and how to stay safe: Kimsuky
- Monitor endpoints for the execution of VBScript, PowerShell, and batch files originating from temporary directories after document opens.
- Inspect network traffic for connections to new or untrusted command and control endpoints, particularly on port 443.
- Review processes spawned by Hangul or other office applications for unexpected child processes like PDF editors or script hosts.
- Implement application control policies to restrict the execution of scripts and backdoors unless explicitly authorized by the organization.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What type of file initiates the Kimsuky attack?
The attack begins with a malicious Hangul document named resume.hwp, which is disguised as a resume to trick users into opening it.
How does the malware progress from the document to ransomware?
The document extracts files and uses a hyperlink to launch scripts that install a Python backdoor and Quasar RAT, which then deploys Funhouse ransomware.
Is this a new ransomware operation by Kimsuky?
No, analysts indicate this is a continuation of previous campaigns, linking the September 2026 activity to earlier Endpoint ransomware deployments.
