Kimsuky's seafood-invoice LNK campaign abuses Backblaze B2 cloud storage as C2 and exfiltration infrastructure, keyed by victim BIOS serial number

AhnLab ASEC attributes a new malicious-LNK campaign to Kimsuky based on code and behavioural overlap with prior Kimsuky LNK operations: matching PowerShell extraction syntax, the same fixed-offset method of extracting data embedded in the LNK, and the same Task Scheduler registration pattern (AhnLab ASEC, 2026-09-01). The lure is a spearphishing attachment named "[Royal Hotel Seoul] Request for Review of Seafood Ingredient Purchases.LNK." Running it uses PowerShell to extract embedded data: it drops a legitimate-looking decoy .hwp document at the same path, displayed to the victim, while simultaneously writing an XOR-encrypted ZIP to C:\ProgramData\systmp\sunshine containing a PowerShell script (termsvc.ps1) and a JScript file, saved separately as C:\ProgramData\systmp\ping_<first-4-UUID-digits>.js (AhnLab ASEC, 2026-09-01). Persistence is a Scheduled Task named MicrosoftOffice2016_<first-4-UUID-digits> that runs the JS file via wscript.exe roughly every 14 minutes; the obfuscated script checks for the presence of termsvc.ps1 and bypasses the PowerShell execution policy to run it hidden (AhnLab ASEC, 2026-09-01). termsvc.ps1 collects OS name and architecture, system timezone, public IP (queried via api.ipify.org), username, domain, the running-process list, and computer name, then authenticates to the Backblaze B2 API and uploads the collected data to a per-victim path keyed on the BIOS serial number, a legitimate cloud-storage service used as command-and-control infrastructure rather than attacker-registered domains (AhnLab ASEC, 2026-09-01). It then polls the same B2 path for a follow-up command file, saves it under an arbitrary name as a .cmd in %TEMP%, executes it hidden via cmd.exe /c, and deletes the local copy roughly 120 seconds later. The actor deletes the original LNK and the intermediate ZIP during execution, leaving only the components needed for the persistence loop.

Triage: authenticated outbound HTTPS traffic to Backblaze B2 API endpoints from a workstation with no legitimate backup or storage use case, alongside a Scheduled Task invoking wscript.exe against a script under C:\ProgramData on a short (~14-minute) interval, is the reusable detection hook, it generalises beyond this campaign to "legitimate cloud storage abused as C2," a pattern increasingly common across unrelated actors, not only Kimsuky.