TLDR Tech / InfoSec
We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerShell Keylogger
Breakglass Intelligence recovered the complete three-stage Kimsuky (APT43) kill chain after the C2 at check[.]nid-log[.]com was found with directory listing enabled, exposing a CHM dropper that chains hh.exe → PowerShell → certutil → wscript into a fileless VBScript recon payload (bootservice.php), a PowerShell bridge (checkservice.php), and a full keylogger with clipboard monitoring and randomized 100-140 minute exfil via multipart POST to finalservice.php. Two novel endpoints (checkservice.php, finalservice.php), the Global\AlreadyRunning19122345 mutex, typo'd User-Agents (Chremo, Edgo), and a 79-domain infrastructure map across 5 IPs spanning DAOU Technology and LightNode were published for the first time, with cross-campaign links to the previously documented udalyonka/uncork[.]biz cluster. Defenders can hunt for HTTP requests to /bootservice.php?tag=&query=*, responses containing “Million OK !!!!”, scheduled tasks named “Edge Updater” at PT60M intervals, and Office_Config.xml writes under %APPDATA%\Microsoft\Windows\Templates.
Read the full story