MB-0010

2026-06-29 • Synaptic Security • Inside Kimsuky’s CHM Tradecraft: Multi-Stage Exec…

MB-0010 is a tracking label associated with APT43 and Kimsuky activity. A documented intrusion used a Korean-language CHM decoy to launch hidden PowerShell, retrieve staged VBScript, profile the host, establish scheduled-task persistence, exfiltrate system inventory, and conditionally retrieve a final payload.

Related Actors

Related Reports in This Cluster

Top Authors

View MB-0010 reports only

2026-10-21
Nextron Systems
#Kimsuky #LNK
2026-10-16
Ahnlab
#FamousChollima #ContagiousInterview #OtterCookie #PolinRider #Kimsuky #Konni #VelvetCake
2026-10-16
Ahnlab
#FamousChollima #ContagiousInterview #OtterCookie #PolinRider #Kimsuky #Konni #VelvetCake
2026-10-15
Qihoo360
#Phishing #GitHub #APT-C-55 #LNK
2026-10-12
Ahnlab
#Kimsuky #Funhouse #Endpoint #QuasarRAT #Ransomware #Hangul
2026-10-12
Ahnlab
#Kimsuky #Ransomware #QuasarRAT #Hangul #Funhouse #Endpoint
2026-10-11
Genians
#Kimsuky #GitPower #Phishing #GitHub #LNK
2026-10-11
Genians
#Kimsuky #GitPower #GitHub #Phishing #LNK
2026-09-30
Ahnlab
#Kimsuky #Phishing #LNK #AutoIt #GitHub #PubNub #XenoRAT #Hangul #T1059.001 #T1053.005 #T1574.002 #T1566.001
2026-09-30
Ahnlab
#Kimsuky #AutoIt #GitHub #Hangul #LNK #Phishing #PubNub #T1053.005 #T1059.001 #T1566.001 #T1574.002 #XenoRAT
2026-09-18
Ahnlab
#FamousChollima #PolinRider #JasperSleet #Kimsuky #Lazarus #DreamJob #CVE-2026-68820 #Trend
2026-09-18
Ahnlab
#FamousChollima #JasperSleet #Kimsuky #Lazarus #DreamJob #CVE-2026-68820 #PolinRider #Trend
2026-09-16
Hive Pro
#Kimsuky #Espionage #Phishing #GitPower #KabarCobra #AppleSeed #PebbleDash #Windows #Android #GitHub #CVE-2017-11882 #CVE-2018-0802 #CVE-2019-0708 #CVE-2024-1709 #T1566.001 #T1566.002 #T1204.002 #T1059.001 #T1053.005 #T1497.001 #T1070.003 #T1056.001 #T1555.003 #T1003.001 #T1113 #T1115 #T1219 #T1567.002
2026-09-10
Qihoo360
#LNK #LOTL #APT-C-55
2026-09-09
ESTSecurity
#Kimsuky #LNK #GitHub #LOTL #T1053.005 #T1057 #T1082 #T1083 #T1087.001 #T1105 #T1140 #T1204.002 #T1567.002 #T1016

View MB-0010 reports only