Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C2

Security researchers have uncovered a campaign in which threat actors are using Visual Studio Code extensions and GitHub as a command-and-control infrastructure to deliver multi-stage malware capable of deploying ransomware and conducting system reconnaissance, according to Kimsuky, the North Korean-backed threat group.

The campaign’s initial infection vector starts with a JavaScript file named Themes.js that downloads and executes additional payloads from iuh234.medianewsonline[.]com, with the compromised device name passed as a parameter along with a hardcoded key.

The attackers exploited Median News as a hosting platform to house malicious payloads and C2 activity, and the second stage collects system details, enumerates processes, and catalogs Users directory files before exfiltration via POST requests to attacker-controlled domains. Persistence is achieved through a scheduled task named “Windows Theme Manager” that runs every minute and re-executes Themes.js, while a Word document titled E-CARD.docx may be used as a lure. The campaign also features data exfiltration prior to final payload deployment and uses cabinet files encoded via the certutil LOLBIN.