Kimsuky APT Deploys Dual KimJongRAT Payloads, Switching Between PE/PowerShell Based on Windows Defender Status

The ENKI WhiteHat Threat Research Team has published an investigation detailing a sophisticated cyber-espionage campaign by the North Korean threat actor Kimsuky, utilizing upgraded variants of KimJongRAT in South Korea. The attack employs phishing emails impersonating public agencies, delivering malicious payloads through weaponized LNK files and Google Drive-hosted content. The malware dynamically selects its payload based on the status of Windows Defender, deploying either a PE dropper or a PowerShell RAT.

Key functionalities of the malware include data theft from browsers and email clients, clipboard capture, and keylogging. The report also highlights the use of phishing sites that mimic legitimate South Korean services to steal credentials. The findings align with previous reports linking Kimsuky to similar tactics and underscore the evolving nature of their cyber operations.