2026-09-03 · view entry permalink →
Kimsuky's seafood-invoice LNK campaign abuses Backblaze B2 cloud storage as C2 and exfiltration infrastructure, keyed by victim BIOS serial number
AhnLab ASEC attributes a new malicious-LNK campaign to Kimsuky based on code and behavioural overlap with prior
Kimsuky LNK operations: matching PowerShell extraction syntax, the same fixed-offset method of extracting data
embedded in the LNK, and the same Task Scheduler registration pattern
(AhnLab ASEC, 2026-09-01). The lure is a spearphishing attachment named
"[Royal Hotel Seoul] Request for Review of Seafood Ingredient Purchases.LNK." Running it uses PowerShell to extract
embedded data: it drops a legitimate-looking decoy .hwp document at the same path, displayed to the victim, while
simultaneously writing an XOR-encrypted ZIP to C:\ProgramData\systmp\sunshine containing a PowerShell script
(termsvc.ps1) and a JScript file, saved separately as C:\ProgramData\systmp\ping_<first-4-UUID-digits>.js
(AhnLab ASEC, 2026-09-01). Persistence is a Scheduled Task named
MicrosoftOffice2016_<first-4-UUID-digits> that runs the JS file via wscript.exe roughly every 14 minutes; the
obfuscated script checks for the presence of termsvc.ps1 and bypasses the PowerShell execution policy to run it
hidden (AhnLab ASEC, 2026-09-01). termsvc.ps1 collects OS name and
architecture, system timezone, public IP (queried via api.ipify.org), username, domain, the running-process list,
and computer name, then authenticates to the Backblaze B2 API and uploads the collected data to a per-victim path
keyed on the BIOS serial number, a legitimate cloud-storage service used as command-and-control infrastructure
rather than attacker-registered domains
(AhnLab ASEC, 2026-09-01). It then polls the same B2 path for a follow-up
command file, saves it under an arbitrary name as a .cmd in %TEMP%, executes it hidden via cmd.exe /c, and
deletes the local copy roughly 120 seconds later. The actor deletes the original LNK and the intermediate ZIP
during execution, leaving only the components needed for the persistence loop.
Triage: authenticated outbound HTTPS traffic to Backblaze B2 API endpoints from a workstation with no
legitimate backup or storage use case, alongside a Scheduled Task invoking wscript.exe against a script under
C:\ProgramData on a short (~14-minute) interval, is the reusable detection hook, it generalises beyond this
campaign to "legitimate cloud storage abused as C2," a pattern increasingly common across unrelated actors, not
only Kimsuky.
In this attack, Backblaze B2 was used not merely as a file storage space but as a C2 infrastructure to exfiltrate information from infected PCs and relay follow-up commands.
Based on such similarities in code and behavior, AhnLab determined that this malicious LNK is also linked to the Kim Sukki group.
it is configured to execute ping_<FIRST 4 digits of UUID>.Js approximately every 14 minutes via wscript.Exe