rapid7-Kimsukys-Phishing-and-Payload-Tactics_wp.pdf

This Rapid7 white paper analyzes Kimsuky — a DPRK-linked APT — describing its social‑engineering focused phishing campaigns, delivery chains (email/OneDrive/Google Drive -> RAR -> LNK/CHM -> PowerShell), payloads (embedded/reflective PowerShell loaders, XeroRAT, AppleSeed/AlphaSeed, BabyShark), persistence techniques, and infrastructure patterns; it includes sample artifacts, code snippets, IOCs, and detection recommendations for defenders.