North Korean Hackers Target Pharma Firms with Malware-Laced Excel Attacks

North Korean APT Kimsuky is conducting a targeted campaign against pharmaceutical and life‑science organizations by sending ZIP attachments containing LNK files that masquerade as Excel spreadsheets. When opened the LNK launches cmd.exe and an obfuscated PowerShell chain that decodes payloads, displays a decoy workbook, uploads system info to Dropbox, retrieves further payloads (e.g., JavaScript, scheduled tasks), and establishes persistence to exfiltrate research and credentials.