Persistent Threats from the Kimsuky Group Using RDP Wrapper

AhnLab ASEC reports on Kimsuky’s ongoing spear-phishing campaign using malicious .LNK files that launch PowerShell or mshta to retrieve payloads — notably the PebbleDash backdoor and a custom RDP Wrapper — and also employing proxies, keyloggers, an infostealer called forceCopy, and loader/injector components; the report includes sample detections, MD5 hashes, IPs, and remediation guidance.