Kimsuky hackers have used a malicious résumé document to deploy Funhouse ransomware through a chain of scripts and remote access tools.
The attack begins with a Hangul Word Processor document disguised as a job application, turning a routine work file into an entry point for malware that ultimately encrypts files.
The campaign connects document-based deception with tools used in earlier Endpoint ransomware cases. Opening the résumé drops supporting files, but clicking a link inside it triggers the next stage.
That distinction matters: the visible document acts as bait, while the link starts the process that leads to remote access and ransomware execution.
Researchers from AhnLab Security intelligence Center (ASEC) identified the Funhouse malware delivery case in a report published October 1, 2026. They linked it to earlier Kimsuky activity through shared scripts, Quasar RAT settings, and ransomware traits.
The findings show a change in the initial delivery method rather than a completely new toolset. The public report does not establish how many victims.
Kimsuky Hackers Use Malicious Resume Documents
The malicious file, resume.Hwp, contains embedded Object Linking and Embedding, or OLE, data. When opened, the Hangul process extracts pdf.Exe and pdf.Exe.Manifest into the Windows temporary folder without further user input.
The executable is a VbsEdit script executor, while the manifest contains the malicious script used in the following stage. A hyperlink inside the résumé invites the recipient to open a PDF bearing a person’s name.
Decoy document (Source – ASEC)
Clicking it launches the extracted executable, which runs the manifest script and creates a randomly named batch file. The trigger resembles earlier Kimsuky document tricks: a weaponized HWP research campaign also used embedded files and a clickable link to begin malicious execution.
This is not simply a document that encrypts files when opened. ASEC describes several stages between the résumé and the final payload.
Batch, VBS, and PowerShell scripts run in sequence, followed by a Python-based backdoor, Quasar RAT installation, and Funhouse execution. Quasar RAT serves as the tool used to deploy the ransomware.
The Python stage fits the group’s previous operations. An earlier malicious LNK backdoor campaign used document-themed Windows shortcuts to install a Python backdoor through multiple scripts.
In the Funhouse case, ASEC also found batch code resembling earlier Kimsuky samples. The operators periodically updated this batch component, which provided an additional way to maintain access.
Quasar RAT Connects the Cases
The Quasar RAT sample uses a configuration file with a .dwg extension, storing its command-and-control address, target identifier, and mutex name.
A mutex is a named object programs can use to coordinate activity or avoid running duplicate copies. The latest configuration reports version 4.4.3, compared with version 1.1.8 in the earlier cases.
Although configuration filenames, server addresses, and target details changed, the Quasar mutex stayed the same across the February, June, and September cases.
These matches support ASEC’s assessment of continuity. They also show why investigators should compare settings and code behavior rather than treat each new server or filename as evidence of an unrelated campaign.
Similar batch file code (Source – ASEC)
ASEC identified Funhouse as a variant of Endpoint ransomware. The June Endpoint and September Funhouse samples share the encryption extension, ransom-note filename, mutex, encryption method, key-generation approach, footer size, and footer marker.
The attacker’s contact address changed, but the underlying file-encryption traits remained consistent. Both samples use HC-128 encryption and a 72-byte footer. Their key-generation process combines CryptGenRandom, Curve25519, and SHA-512.
By contrast, the February Endpoint sample used ChaCha20 encryption and a different key-generation method. These differences trace changes within the ransomware family; SHA-512 here describes a cryptographic operation, not a published sample hash.
ASEC said the shift from recently favored LNK files to HWP documents likely aims to lower suspicion. A résumé is a familiar work item, particularly for staff handling job applications.
Earlier Kimsuky recruiter phishing campaigns similarly used fake résumés and business cards, showing how the group shapes lures around a recipient’s normal tasks.
Defenders should watch the full sequence, not just the attachment type: Hangul writing executable and manifest files, followed by unusual script activity and remote access tooling.
ASEC advises checking document links and sender credibility, avoiding suspicious links, updating Hangul and operating systems, and keeping endpoint protection current.
Indicators of compromise (IoCs):-
TypeIndicatorSource contextMD517d97e3ee3185d82812a4014444c36f3Published sample hash; filename not specifiedMD5327617e977eefd15708568f43140e595Published sample hash; filename not specifiedMD53d802ceaf891ea57ecd7d1d786d96a0dPublished sample hash; filename not specifiedMD55be7578bfe633fb268ad97a520abb4e1Published sample hash; filename not specifiedMD578c219a6bec5fc30f43b62e4934646ebPublished sample hash; filename not specifiedURLhttp[:]//daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/adminer/logo[.]php?au=ttListed in ASEC’s IOC sectionURLhttp[:]//daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/enter/logo[.]phpListed in ASEC’s IOC sectionURLhttp[:]//kgbrazing[.]makeway2017[.]gethompy[.]com/skin/board/pym/logo-man[.]phpListed in ASEC’s IOC sectionURLhttp[:]//koocpt[.]site/meta/logo[.]phpListed in ASEC’s IOC sectionURLhttp[:]//masonparkpg[.]dothome[.]co[.]kr/Gorg04/a/logo-man[.]phpListed in ASEC’s IOC sectionIP / C2 port45[.]95[.]186[.]232:80February 2026 Endpoint caseIP / C2 port45[.]43[.]60[.]53:80June 2026 Endpoint caseIP / C2 port70[.]36[.]97[.]236:443September 2026 Funhouse caseDelivery filenameresume.HwpMalicious HWP résuméExtracted filespdf.Exe, pdf.Exe.ManifestWritten into %TEMP%Batch filename patternlpe{random value}.BatCreated by the malicious scriptPDF lure patternresume_{name}.PdfFile offered through the document hyperlinkQuasar configurationdog.dwgSeptember Funhouse caseEarlier Quasar configurationse.dwgFebruary and June Endpoint casesQuasar mutex_QQ_XCZ_VCXZShared across all three comparison casesEncryption extension.FunhouseJune Endpoint and September Funhouse samplesEarlier encryption extension.EndpointFebruary Endpoint sampleRansom-note filenameHow To Restore Your Files.TxtShared across all three ransomware samplesRansomware mutexDoYouWantToHaveSexWithCuongDongJune Endpoint and September Funhouse samplesEarlier ransomware mutexMutexisfunnylocalFebruary Endpoint sampleFooter markerChoung Dong looks like a hot dog!!June Endpoint and September Funhouse samplesContact emailFunhouse8764@tutamail[.]ComSeptember Funhouse sampleEarlier contact emailFunhouseRaaS@proton[.]MeJune Endpoint sampleEarlier contact emailSchipkealfred@gmail[.]ComFebruary Endpoint sample
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
Click Here For The Original Source.
——————————————————–
