Kimsuky deploying QuasarRAT

Summary

Proofpoint ties this chain to TA427, the North Korean group others track as Kimsuky and Emerald Sleet. Operators approached staff at a handful of think tanks working on North Korean affairs with a spoofed meeting invitation, built rapport, then sent a PDF whose link pointed at a dynamic-DNS host dressed up as a corporate file store. Trying to open the decoy document raised a registration pop-up that handed the reader a licence-style code hiding a PowerShell instruction to paste into a terminal. Running it fetched a second script, showed a Japanese foreign-ministry questionnaire as cover, and set scheduled tasks that ran a VBS stager every nineteen minutes. One January 2025 instance went further: batch files decoded a Base64 and XOR-wrapped QuasarRAT that reached its controller over port 80. Delivery names sat on FreeDNS and No-IP services, largely on hacked South Korean servers.

Overlap with other campaigns

We compared the 52 indicators in this record — covering 17 distinct registrable domains — against the 43 other published campaigns in this corpus.

• SHub and MacSync via GitHub lures

  2026-08-29

  No indicator is shared, but the two records use the same registrable domains.

  Shared registrable domain (1)

  • gmail[.]comdomain, shown defanged for safety: gmail dot com

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

Execution mechanisms

The only execution mechanism any published account describes for this campaign is PowerShell (T1059.001), which 19 of the 44 published campaigns in this corpus also record (43%).

Indicators

52 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.