{
  "name": "Live C2 Dump Recovering Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerShell Keylogger",
  "slug": "live-c2-dump-recovering-every-stage-of-the-kill-chain-chm-dropper-vbscript-stager-powershell-keylogger",
  "description": "On April 11, 2026, researchers analyzed a CHM file (api_reference.chm) tagged as Kimsuky that initiated a three-stage attack chain. The C2 server at check[.]nid-log[.]com had directory listing enabled, allowing recovery of complete source code for all payload stages: a 6,338-byte VBScript performing system reconnaissance and establishing persistence via scheduled task, a 449-byte VBScript bridge to PowerShell, and a 6,234-byte PowerShell keylogger with clipboard monitoring and timed exfiltration. The infrastructure included 79+ domains across 5 C2 IPs spanning Korean VPS providers. The server responded with \"Million OK !!!!\" signature, matching previously documented Kimsuky infrastructure while showing upgraded Apache/PHP stack. The operation targeted Korean Naver users through credential phishing and tax authority impersonation, with infrastructure linked to previously documented Kimsuky campaigns via shared DAOU Technology subnets.",
  "published": "2026-04-13T15:10:44.257000+00:00",
  "created_at": "2026-04-13T16:23:34.934000+00:00",
  "modified_at": "2026-04-13T14:23:34+00:00",
  "created_at_opencti": "2026-04-13T16:23:34.934000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "apt43",
    "chm dropper",
    "credential harvesting",
    "dprk",
    "korean targeting",
    "naver phishing",
    "powershell keylogger",
    "vbscript stager"
  ],
  "tags": [
    "2026-04-13",
    "apt43",
    "chm dropper",
    "credential harvesting",
    "dprk",
    "korean targeting",
    "naver phishing",
    "powershell keylogger",
    "vbscript stager"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "2d4e5f89-651c-4571-8904-7e4ad020db19",
        "name": "http://check.nid-log.com/api/bootservice.php?tag="
      },
      {
        "id": "6b17265b-c05b-4a93-80cd-639638e1fbd0",
        "name": "chk.uncork.biz"
      },
      {
        "id": "2fc68b9f-084f-418d-9c96-c8805b6e9774",
        "name": "38.60.220.135"
      },
      {
        "id": "c0024ee4-7624-4ed1-9392-f0e112f18e31",
        "name": "nid-navercwu.servecounterstrike.com"
      },
      {
        "id": "a162a3f4-24c6-4c1b-a109-af90a4b5342b",
        "name": "a36576a096db24a1c91327eb547dedf52e5bd4b0d4593b88d9593d377585b922"
      },
      {
        "id": "a3b2ba3d-304d-4b31-a17c-fb52e2aefe8b",
        "name": "130.94.29.111"
      },
      {
        "id": "d2b0ec1e-7fda-4362-9556-945287ec6b6d",
        "name": "uncork.biz"
      },
      {
        "id": "7777afc4-5466-4dd7-a7b2-c5d9cb149af5",
        "name": "withheldforprivacy.com"
      },
      {
        "id": "4cea9365-0013-443f-aa45-0a38e354fb44",
        "name": "118.194.249.109"
      },
      {
        "id": "9b7800b8-2ecd-43a7-abd0-e17b49a2888d",
        "name": "nid-log.com"
      },
      {
        "id": "7dc7ddac-58c9-42bd-98e4-5b45fcc2fe5f",
        "name": "85f8f8a3f28d2956776fbbd0365cdb78ac8dc1e6ed12818ef18caed0bb2f74c8"
      },
      {
        "id": "7b4bba9f-fb7e-4158-8ab5-be71bb1904d8",
        "name": "tax-invoice.dns.army"
      },
      {
        "id": "ac1e547d-18bf-42f5-adaa-aea8a2c67a02",
        "name": "nid-naverfxc.servecounterstrike.com"
      },
      {
        "id": "a97fb554-983a-4a02-adb8-4b57d07e280a",
        "name": "http://check.nid-log.com/api/finalservice.php"
      },
      {
        "id": "4cc0505a-c327-446e-9843-1eb5c778dfc0",
        "name": "check.nid-log.com"
      },
      {
        "id": "6bb3004e-069b-49d5-8e3c-3788c573d6f0",
        "name": "pay-tax.dns.navy"
      },
      {
        "id": "c5f8c2cc-828f-46ae-9045-b368091ba56c",
        "name": "d7c09e7bf79aa9b786dcd9f870427f4a1110f702646fba9d3835215ad3649d0b"
      },
      {
        "id": "bdd6e3a4-e1e6-478c-a086-cea5231ed1af",
        "name": "1eff237dee95172363bfc0342d0389f809f753a6ec5e6848e57b3fd5482e9793"
      },
      {
        "id": "efc7db0e-2c3c-48aa-ace9-e26349700323",
        "name": "27.102.137.38"
      },
      {
        "id": "fe5b30b5-3501-47cf-b5f1-be6227df7bda",
        "name": "miss-tax.dns.navy"
      },
      {
        "id": "e5dc61cf-a586-4be4-966d-82feeb75fb09",
        "name": "verify.efine-log.kro.kr"
      },
      {
        "id": "71e1212b-3cae-43e1-9a85-5343253d8229",
        "name": "27.102.138.45"
      },
      {
        "id": "978b9c36-1e85-442f-aa74-c0f5b54d4d9e",
        "name": "51.79.185.184"
      },
      {
        "id": "9e79da85-bb10-4b8f-9394-32a59f03778b",
        "name": "nid-naverpep.servequake.com"
      },
      {
        "id": "c19483e9-3d1d-4ea2-81ea-6b8e3c67566a",
        "name": "af50f35701916d3909f2727cdcbde1a7af47f46eb8db3996905b1c0725aa133f"
      },
      {
        "id": "a6846339-3b0d-435f-be4f-aedce581f94a",
        "name": "nid-navertca.servehalflife.com"
      },
      {
        "id": "0626deca-fcac-4143-b49e-40db58a3d0ec",
        "name": "noreplymail.space"
      },
      {
        "id": "d929e7e0-d384-4f4b-9e92-00bfd7616388",
        "name": "7047878f4fbea323148f6554afe616991eb56cc327653972c4213a9017c5e66b"
      },
      {
        "id": "941f1650-55f5-416a-8b33-34471675166c",
        "name": "162.255.119.150"
      },
      {
        "id": "5bce59a0-238e-41d8-b352-38c0d1662867",
        "name": "nid-tax.dns.army"
      },
      {
        "id": "60b5711f-9aa5-416d-9af7-2df818aa900e",
        "name": "http://check.nid-log.com/api/bootservice.php"
      },
      {
        "id": "b6ba86e9-58c6-4369-8e69-89e74687f2dd",
        "name": "http://check.nid-log.com/api/checkservice.php"
      },
      {
        "id": "54740981-a840-48af-9e83-b4d97aeedf96",
        "name": "http://noreplymail.space/BitJoker/bootservice.php"
      },
      {
        "id": "8c4bed01-aceb-49b4-93df-2161e02a330c",
        "name": "nid-htl.duckdns.org"
      },
      {
        "id": "1975f10b-5069-46ea-ab48-05ded4624090",
        "name": "http://check.nid-log.com/api'"
      },
      {
        "id": "6030b839-b17d-4177-9223-9b3a107215aa",
        "name": "27.102.137.150"
      }
    ],
    "intrusion_sets": [
      {
        "id": "294d962a-b24e-446b-8e2d-3706cb1316b3",
        "name": "Kimsuky",
        "slug": "kimsuky"
      }
    ],
    "attack_patterns": [
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "cf746a02-00ea-419e-912d-7b03f969c491",
        "name": "T1518.001"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "667462db-9031-48eb-893a-05d35f9330a7",
        "name": "T1056.001"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "9e784d22-5a6c-4da6-968a-5fab2f019efd",
        "name": "T1059.005"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "6f00068c-812c-4e2b-9100-2cfa86b3aed9",
        "name": "T1132.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "f4a450ef-8297-42e5-9e47-01162138baa2",
        "name": "T1115"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "observables": [
      {
        "id": "7c57b1b2-1e7b-4671-9b3a-e3209b335249",
        "name": "uncork.biz"
      },
      {
        "id": "e04f2951-af1c-4cad-a1c9-4fd5c19aa6d7",
        "name": "noreplymail.space"
      },
      {
        "id": "6e2c68f2-ff3d-4a72-8c0c-ab8d64cf3f14",
        "name": "withheldforprivacy.com"
      },
      {
        "id": "dbb4c87c-4d2d-4c74-a63f-146f0aab3fee",
        "name": "nid-log.com"
      },
      {
        "id": "1e06c73f-ae76-4253-9595-36b99d56bfac",
        "name": "nid-htl.duckdns.org"
      },
      {
        "id": "f2c7a494-c6fa-4174-ace5-4f77829d5abd",
        "name": "verify.efine-log.kro.kr"
      },
      {
        "id": "c6ba9faa-b167-48fe-b16d-104f0fe9ce6e",
        "name": "miss-tax.dns.navy"
      },
      {
        "id": "12251411-1f57-4a92-a80a-337f80e8d848",
        "name": "tax-invoice.dns.army"
      },
      {
        "id": "a6374c60-db5b-4e99-bf23-448e4d20658e",
        "name": "nid-navertca.servehalflife.com"
      },
      {
        "id": "3529a924-89b3-4f11-a332-89227631528c",
        "name": "nid-tax.dns.army"
      },
      {
        "id": "9423496b-780e-47e7-9b95-4012a6eb49c6",
        "name": "check.nid-log.com"
      },
      {
        "id": "abf603a0-acc3-4ad6-a7cb-739c90a680f3",
        "name": "nid-naverfxc.servecounterstrike.com"
      },
      {
        "id": "24457340-7481-4b5c-a2af-04371477f0f4",
        "name": "nid-naverpep.servequake.com"
      },
      {
        "id": "97679abe-a372-4711-aadf-10ce003937de",
        "name": "nid-navercwu.servecounterstrike.com"
      },
      {
        "id": "df6a31b4-22b0-4ea4-b3cc-e46eecb4c40a",
        "name": "pay-tax.dns.navy"
      },
      {
        "id": "0bbdeada-53be-49f8-93c7-385e090ef3eb",
        "name": "chk.uncork.biz"
      },
      {
        "id": "5f7922f2-6fb4-40ec-aba5-5f6c0af03ca5",
        "name": "51.79.185.184"
      },
      {
        "id": "ffa61eab-a665-4aff-a34a-3b65830abbe1",
        "name": "27.102.137.150"
      },
      {
        "id": "aa1027bf-c0b5-4de9-9c5b-013c5637409f",
        "name": "118.194.249.109"
      },
      {
        "id": "ff41646e-ce8b-4337-b241-ffd00d2dc0c8",
        "name": "130.94.29.111"
      },
      {
        "id": "7fb181fa-ebb2-4517-95ed-2f6a2b4ade63",
        "name": "38.60.220.135"
      },
      {
        "id": "732bf027-1a6b-48b6-824b-f71c1e4a94f0",
        "name": "27.102.138.45"
      },
      {
        "id": "4d7e56b1-09cf-44fb-83c9-edcb8214ad53",
        "name": "27.102.137.38"
      },
      {
        "id": "19057aab-02be-4970-9504-1921eeec74f5",
        "name": "162.255.119.150"
      },
      {
        "id": "7edcd8f3-bc92-41fa-b166-247414dbc003",
        "name": "http://check.nid-log.com/api/checkservice.php"
      },
      {
        "id": "1e51a296-d190-443d-865d-30fb57e48685",
        "name": "http://check.nid-log.com/api/bootservice.php"
      },
      {
        "id": "e56c31e9-910f-45f5-9061-586770335c6c",
        "name": "http://noreplymail.space/BitJoker/bootservice.php"
      },
      {
        "id": "98bf2d23-eadb-4f88-8595-78358c5f14f7",
        "name": "http://check.nid-log.com/api/finalservice.php"
      },
      {
        "id": "94b1cdb8-6725-48f9-a21a-b8c39a7a0b74",
        "name": "http://check.nid-log.com/api/bootservice.php?tag="
      },
      {
        "id": "e2bd2fa7-5b45-40a8-8de6-d2a543293649",
        "name": "http://check.nid-log.com/api'"
      },
      {
        "id": "",
        "name": "a36576a096db24a1c91327eb547dedf52e5bd4b0d4593b88d9593d377585b922"
      },
      {
        "id": "",
        "name": "85f8f8a3f28d2956776fbbd0365cdb78ac8dc1e6ed12818ef18caed0bb2f74c8"
      },
      {
        "id": "",
        "name": "d7c09e7bf79aa9b786dcd9f870427f4a1110f702646fba9d3835215ad3649d0b"
      },
      {
        "id": "",
        "name": "1eff237dee95172363bfc0342d0389f809f753a6ec5e6848e57b3fd5482e9793"
      },
      {
        "id": "",
        "name": "af50f35701916d3909f2727cdcbde1a7af47f46eb8db3996905b1c0725aa133f"
      },
      {
        "id": "",
        "name": "7047878f4fbea323148f6554afe616991eb56cc327653972c4213a9017c5e66b"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "chk.uncork.biz"
      },
      {
        "id": "",
        "name": "nid-navercwu.servecounterstrike.com"
      },
      {
        "id": "",
        "name": "uncork.biz"
      },
      {
        "id": "",
        "name": "withheldforprivacy.com"
      },
      {
        "id": "",
        "name": "nid-log.com"
      },
      {
        "id": "",
        "name": "tax-invoice.dns.army"
      },
      {
        "id": "",
        "name": "nid-naverfxc.servecounterstrike.com"
      },
      {
        "id": "",
        "name": "check.nid-log.com"
      },
      {
        "id": "",
        "name": "pay-tax.dns.navy"
      },
      {
        "id": "",
        "name": "miss-tax.dns.navy"
      },
      {
        "id": "",
        "name": "verify.efine-log.kro.kr"
      },
      {
        "id": "",
        "name": "nid-naverpep.servequake.com"
      },
      {
        "id": "",
        "name": "nid-navertca.servehalflife.com"
      },
      {
        "id": "",
        "name": "noreplymail.space"
      },
      {
        "id": "",
        "name": "nid-tax.dns.army"
      },
      {
        "id": "",
        "name": "nid-htl.duckdns.org"
      }
    ]
  },
  "external_refs": [
    {
      "id": "102211fd-5ab7-4d23-ae62-0a4fabce135c",
      "standard_id": "external-reference--533e2e60-f8a9-58a2-9b14-805739a5182a",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://intel.breakglass.tech/post/kimsuky-chm-nidlog-c2-dump-full-payload-recovery",
      "hash": null,
      "external_id": null,
      "created": "2026-04-13T16:23:27.530Z",
      "modified": "2026-04-13T16:23:27.530Z",
      "createdById": null
    },
    {
      "id": "1157ecce-f475-42a7-9942-79b4016648af",
      "standard_id": "external-reference--fecc6f32-8eb8-5c91-8ebc-459b6ec7d4bc",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/69dd07742196e34ee1615b73",
      "hash": null,
      "external_id": "69dd07742196e34ee1615b73",
      "created": "2026-04-13T16:23:27.479Z",
      "modified": "2026-04-13T16:23:27.479Z",
      "createdById": null
    }
  ]
}