Kimsuky__2021__Inquest_Kimsuky-Espionage-Campaign_08-23-2021.pdf

Kimsuky Espionage Campaign — analysis shows a malicious JavaScript disguised as a PDF that decodes embedded Base64 payloads to drop and execute an UPX-packed DLL which unpacks into a Kimsuky spyware DLL. The malware searches for document filetypes (including on USB drives), implements keylogging and persistence via regsvr32/RunOnce, and the report provides file hashes and a network IoC for detection and hunting.