Kimsuky Hackers Deploy Funhouse Ransomware via Malicious Resume Documents
The Kimsuky threat group is leveraging weaponized Hangul Word Processor documents disguised as résumés to deploy the Funhouse ransomware, employing a multi-stage attack chain involving OLE data extraction, script execution, and remote access tools.
The notorious Kimsuky threat actor group has been observed employing a sophisticated attack vector that uses malicious Hangul Word Processor (HWP) documents, disguised as job résumés, to deploy the Funhouse ransomware. This tactic transforms a seemingly innocuous work-related file into a potent entry point for malware that ultimately leads to file encryption on victim systems. Researchers from AhnLab Security Intelligence Center (ASEC) detailed this campaign, noting that it combines document-based deception with tools previously associated with Endpoint ransomware variants, indicating an evolution in the group's delivery methods rather than a complete overhaul of their toolkit.
The attack chain is initiated when a victim opens a malicious HWP file, named 'resume.Hwp'. This document contains embedded Object Linking and Embedding (OLE) data, which, upon opening, prompts the Hangul process to extract two files into the Windows temporary folder without requiring further user interaction: 'pdf.Exe' and 'pdf.Exe.Manifest'. The 'pdf.Exe' file is actually a VbsEdit script executor, while the manifest file contains the malicious script that orchestrates the subsequent stages of the attack. This initial extraction is designed to be stealthy, relying on the user's trust in the document's purported purpose.
The next stage is triggered by a hyperlink embedded within the résumé document itself, often presented as a link to open a PDF file with a person's name. Clicking this link executes the previously extracted 'pdf.Exe' file. This action initiates a sequence of malicious activities, including the creation of a randomly named batch file. This technique of using a clickable link within a weaponized document to commence malicious execution has been observed in previous Kimsuky campaigns, highlighting the group's consistent reliance on social engineering tactics.
Following the execution of the initial script, a complex series of batch, VBS, and PowerShell scripts are run in succession. This layered scripting approach is designed to evade detection and establish a foothold on the compromised system. The ultimate goal of this script chain is to install a Python-based backdoor, identified as Quasar RAT, which then serves as the primary tool for deploying the Funhouse ransomware. The use of Quasar RAT is a significant link to Kimsuky's prior operations, demonstrating continuity in their infrastructure and operational methods.
Researchers noted that the Quasar RAT samples utilized in this campaign featured configuration files with a .dwg extension, storing critical information such as command-and-control (C2) server addresses, target identifiers, and mutex names. While the version number and specific configuration details have evolved (e.g., version 4.4.3 in recent attacks compared to 1.1.8 in earlier ones), the mutex name remained consistent across different attack periods. This consistency in core components, despite superficial changes, underscores the importance of analyzing code behavior and configuration settings rather than solely focusing on new indicators like server addresses or filenames.
Funhouse ransomware has been identified as a variant of the Endpoint ransomware family. Analysis revealed that both the June Endpoint and September Funhouse samples share several key characteristics, including the encryption file extension, the ransom note filename, the mutex used, the encryption method (HC-128), the key-generation approach, and footer size and marker. Although the attacker's contact address has changed, the fundamental file-encryption traits remain consistent, indicating a shared codebase and development lineage within the ransomware family.
The shift from previously favored LNK files to HWP documents as the initial attack vector is likely a strategic move by Kimsuky to reduce suspicion. A résumé is a common and familiar document, especially for individuals involved in recruitment or HR processes. This tactic aligns with Kimsuky's history of crafting lures that closely mimic the recipient's normal work activities, as seen in their earlier phishing campaigns using fake résumés and business cards. Security professionals are advised to monitor the entire attack sequence, from document opening and script execution to the deployment of remote access tools and ransomware, rather than focusing solely on the attachment type.
To mitigate these threats, ASEC recommends vigilance regarding document links and sender credibility, avoiding suspicious links, ensuring Hangul and operating systems are up-to-date, and maintaining current endpoint protection solutions. The campaign highlights the persistent evolution of threat actor tactics, emphasizing the need for comprehensive security awareness and robust technical defenses.