Kimsuky Hackers Use Malicious Resume Documents to Deploy Funhouse Ransomware

Kimsuky hackers have used a malicious résumé document to deploy Funhouse ransomware through a chain of scripts and remote access tools.

The attack begins with a Hangul Word Processor document disguised as a job application, turning a routine work file into an entry point for malware that ultimately encrypts files.

The campaign connects document-based deception with tools used in earlier Endpoint ransomware cases. Opening the résumé drops supporting files, but clicking a link inside it triggers the next stage.

That distinction matters: the visible document acts as bait, while the link starts the process that leads to remote access and ransomware execution.

Researchers from AhnLab Security intelligence Center (ASEC) identified the Funhouse malware delivery case in a report published October 1, 2026. They linked it to earlier Kimsuky activity through shared scripts, Quasar RAT settings, and ransomware traits.

The findings show a change in the initial delivery method rather than a completely new toolset. The public report does not establish how many victims.

Kimsuky Hackers Use Malicious Resume Documents

The malicious file, resume.Hwp, contains embedded Object Linking and Embedding, or OLE, data. When opened, the Hangul process extracts pdf.Exe and pdf.Exe.Manifest into the Windows temporary folder without further user input.

The executable is a VbsEdit script executor, while the manifest contains the malicious script used in the following stage. A hyperlink inside the résumé invites the recipient to open a PDF bearing a person’s name.

Clicking it launches the extracted executable, which runs the manifest script and creates a randomly named batch file. The trigger resembles earlier Kimsuky document tricks: a weaponized HWP research campaign also used embedded files and a clickable link to begin malicious execution.

This is not simply a document that encrypts files when opened. ASEC describes several stages between the résumé and the final payload.

Batch, VBS, and PowerShell scripts run in sequence, followed by a Python-based backdoor, Quasar RAT installation, and Funhouse execution. Quasar RAT serves as the tool used to deploy the ransomware.

The Python stage fits the group’s previous operations. An earlier malicious LNK backdoor campaign used document-themed Windows shortcuts to install a Python backdoor through multiple scripts.

In the Funhouse case, ASEC also found batch code resembling earlier Kimsuky samples. The operators periodically updated this batch component, which provided an additional way to maintain access.

Quasar RAT Connects the Cases

The Quasar RAT sample uses a configuration file with a .dwg extension, storing its command-and-control address, target identifier, and mutex name.

A mutex is a named object programs can use to coordinate activity or avoid running duplicate copies. The latest configuration reports version 4.4.3, compared with version 1.1.8 in the earlier cases.

Although configuration filenames, server addresses, and target details changed, the Quasar mutex stayed the same across the February, June, and September cases.

These matches support ASEC’s assessment of continuity. They also show why investigators should compare settings and code behavior rather than treat each new server or filename as evidence of an unrelated campaign.

ASEC identified Funhouse as a variant of Endpoint ransomware. The June Endpoint and September Funhouse samples share the encryption extension, ransom-note filename, mutex, encryption method, key-generation approach, footer size, and footer marker.

The attacker’s contact address changed, but the underlying file-encryption traits remained consistent. Both samples use HC-128 encryption and a 72-byte footer. Their key-generation process combines CryptGenRandom, Curve25519, and SHA-512.

By contrast, the February Endpoint sample used ChaCha20 encryption and a different key-generation method. These differences trace changes within the ransomware family; SHA-512 here describes a cryptographic operation, not a published sample hash.

ASEC said the shift from recently favored LNK files to HWP documents likely aims to lower suspicion. A résumé is a familiar work item, particularly for staff handling job applications.

Earlier Kimsuky recruiter phishing campaigns similarly used fake résumés and business cards, showing how the group shapes lures around a recipient’s normal tasks.

Defenders should watch the full sequence, not just the attachment type: Hangul writing executable and manifest files, followed by unusual script activity and remote access tooling.

ASEC advises checking document links and sender credibility, avoiding suspicious links, updating Hangul and operating systems, and keeping endpoint protection current.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Kimsuky Hackers Use Malicious Resume Documents to Deploy Funhouse Ransomware appeared first on Cyber Security News.