Kimsuky__2023__Ahnlab_Kimsuky-Group-AutoIt-Malware-RftRAT-Amadey_12-08-2023.pdf

ASEC (AhnLab) reports that the Kimsuky APT group has been using LNK-based spear-phishing to deploy remote-access malware (Amadey, RftRAT, xRAT) and infostealers in 2023, with recent variants ported to AutoIt and packed with VMP; the report details infection chains, persistence and UAC bypass techniques, DGA usage, IOCs (MD5s, C2 domains/IPs), and post-infection tooling such as keyloggers, browser credential stealers, and RDP-related malware.