Kimsuky APT Uses JavaScript Loader and Certutil to Achieve Minute-by-Minute Persistence via Windows Scheduled Task

The article, according to Pulsedive Threat Research, describes a new JavaScript-driven espionage campaign from the North Korean APT group Kimsuky that targets government entities, think tanks and policy experts. It details a multi-stage infection chain beginning with a JavaScript downloader called Themes.js that downloads and executes content from an attacker-controlled domain, specifically via a GET request to iuh234.medianewsonline[.]com/dwnkl.php with the compromised computer’s uid and a hardcoded key (kx).

The server returns another JavaScript file containing five functions; one group of functions conducts extensive host reconnaissance and exfiltrates data encoded and archived into .cab files using certutil, posting them to /umprl.php?uid=. For each POST, the C2 delivers a new JavaScript payload that creates persistence and deploys a decoy Word document.

The persistence function, MKSCHD, creates a Windows scheduled task named Windows Theme Manager that runs every minute with wscript.exe to execute Themes.js from %APPDATA%\Microsoft\Windows\Themes\. The decoy, OPDOM, drops a base64-encoded E-CARD.docx into the %Public% directory and decodes it with certutil, appearing empty when opened.