A new remote access trojan, known as KimJongRAT, has emerged and poses a serious threat to Windows users. The sophisticated malware is attributed to the Kimsuky, a threat actor believed to have state support.
See also: Hackers exploit vulnerability in Triofox to install RAT
The attack usually begins with a phishing email that includes a deceptive zip file named “National Tax Notice”, which lures unsuspecting victims into starting the infection chain.
When the malicious file is opened, the user sees a shortcut file that appears to be a valid PDF. When executed, the shortcut triggers a hidden command that decodes a Base64 URL and leverages the legitimate Microsoft HTML Application to communicate with a remote server.
See also: Bloody Wolf expands attacks with Java-based NetSupport RAT
This silently downloads an additional payload named tax.hta, bypassing standard security mechanisms. Security analysts at Alyac discovered that the loading script is written in VBScript and uses clever evasion techniques.
The malware tries to remain invisible by utilizing legitimate services, such as Google Drive, to host its malicious elements.
See also: Remcos RAT C2 activity mapped
Once activated, the loader downloads both deceptive documents to deceive the user and the actual malicious files required for the next stage of the attack.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
