The Python Pivot: Kimsuky’s New Multi-Stage LNK Maze for Stealthy Backdoors

AhnLab ASEC reports that the Kimsuky threat group has evolved its delivery chain from simple LNK→PowerShell→BAT flows to a multi-stage LNK→PowerShell→VBScript→Python sequence, using decoy documents, Dropbox-hosted archives, Python-based backdoors, and Task Scheduler persistence to evade detection; security teams are advised to monitor suspicious LNK activity and execution of PowerShell/Python from temporary directories.