N. Korea-linked Kimsuky Shifts to Compiled HTML Help Files in Ongoing Cyberattacks

Kimsuky, a North Korea-linked APT, is actively shifting tactics to use CHM files (delivered within ISOs, VHDs, ZIP/RAR) and other weaponized documents to execute JavaScript/VBScript that establishes persistence and fetches next-stage payloads (Endoor backdoor, Troll Stealer) for data theft; operations target South Korea and international organizations, reuse code and tools, and may incorporate generative AI to support phishing or coding.