Kimsuky & Void Arachne Surge: KimJongRAT, XenoRAT & DcRAT Campaigns Targeting Asian Infrastructure

---
title: Suspicious LNK File with PowerShell Command Line
id: 8b2f4c11-9e3d-4b5a-8c1d-2e3f4a5b6c7d
description: Detects execution of LNK files that trigger PowerShell, a common technique used by Kimsuky to deliver malware like XenoRAT and PebbleDash via spear-phishing.
author: Security Arsenal
date: 2026/07/26
status: stable
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\explorer.exe'
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - '-NoP'
            - '-W Hidden'
            - '-ExecutionPolicy'
            - 'DownloadString'
    condition: selection
falsepositives:
    - Admin scripts
level: high
tags:
    - attack.t1204.002
    - attack.t1566.001
---
title: Network Connection to Kimsuky and Void Arachne Infrastructure
id: 9a3e5d22-0f4e-5c6b-9d2e-3f4a5b6c7d8e
description: Detects outbound connections to domains associated with KimJongRAT, DcRAT, and related APT infrastructure identified in OTX pulses.
author: Security Arsenal
date: 2026/07/26
status: experimental
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|contains:
            - 'servequake.com'
            - 'corpsecs.com'
            - 'bohyeonsanvil.com'
            - 'kumhosports.com'
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.t1071.001
---
title: Potential GitHub Abuse for Malware Delivery
id: 1b4f6e33-1a5b-6c7d-0e3f-4a5b6c7d8e9f
description: Detects processes downloading content from GitHub Releases or raw content, a tactic abused by Kimsuky to host KimJongRAT payloads.
author: Security Arsenal
date: 2026/07/26
status: experimental
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains: 'github.com'
        DestinationHostname|contains:
            - '/releases/download/'
            - '/raw/'
        Initiated: 'true'
    condition: selection
falsepositives:
    - Legitimate software updates via GitHub
level: medium
tags:
    - attack.t1102.002


kql
// Hunt for connections to specific IOCs in DeviceNetworkEvents
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("servequake.com", "corpsecs.com", "bohyeonsanvil.com", "kumhosports.com") 
or RemoteIP in (""/* Add specific IPs if resolved */) 
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemotePort, InitiatingProcessCommandLine
| extend AlertType = "C2_Communication_Detected"


powershell
# IOC Hunt Script for Kimsuky & Void Arachne Campaigns
# Checks for specific registry artifacts, file paths, and network connections

$IOC_Domains = @(
    "servequake.com", 
    "corpsecs.com", 
    "bohyeonsanvil.com", 
    "kumhosports.com",
    "lutkdd.corpsecs.com"
)

Write-Host "[+] Starting Hunt for Kimsuky/Void Arachne IOCs..." -ForegroundColor Cyan

# 1. Check Hosts File for Indicators
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    Write-Host "[+] Checking Hosts file..." -ForegroundColor Yellow
    $HostsContent = Get-Content $HostsPath
    foreach ($Domain in $IOC_Domains) {
        if ($HostsContent -match $Domain) {
            Write-Host "[!] ALERT: Found $Domain in hosts file." -ForegroundColor Red
        }
    }
}

# 2. Check Active DNS Cache for suspicious domains
Write-Host "[+] Checking DNS Cache..." -ForegroundColor Yellow
try {
    $DnsCache = Get-DnsClientCache | Select-Object Entry, Data
    foreach ($Entry in $DnsCache) {
        foreach ($Domain in $IOC_Domains) {
            if ($Entry.Entry -like "*$Domain*") {
                Write-Host ("[!] ALERT: DNS Cache entry found for {0} resolving to {1}" -f $Entry.Entry, $Entry.Data) -ForegroundColor Red
            }
        }
    }
} catch {
    Write-Host "[-] Could not read DNS Cache (Admin rights required)." -ForegroundColor Gray
}

# 3. Check for suspicious Scheduled Tasks (Common Persistence)
Write-Host "[+] Checking Scheduled Tasks..." -ForegroundColor Yellow
$SuspiciousTasks = Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*powershell*" -or $_.Actions.Execute -like "*cmd*" }
foreach ($Task in $SuspiciousTasks) {
    # Heuristic: Tasks invoking scripts from AppData or Temp
    if ($Task.Actions.Arguments -match "AppData|Temp|Public") {
        Write-Host ("[!] Suspicious Task Found: {0} - Action: {1}" -f $Task.TaskName, $Task.Actions.Execute) -ForegroundColor Red
    }
}

Write-Host "[+] Hunt Complete." -ForegroundColor Green