Check Point Research
25th August – Threat Intelligence Report · 2025-08-25
Researchers detailed a campaign by North Korean APT group Kimsuky targeting embassies and diplomatic missions in South Korea and globally. The campaign used spear-phishing emails with contextual diplomatic lures to deliver XenoRAT via malicious LNK files and PowerShell scripts, leveraging GitHub and cloud platforms for command-and-control and data exfiltration.