Kimsuky XenoRAT + FrostyNeighbor Wiper Campaign: OTX Pulse Analysis — Enterprise Detection Pack | Security Arsenal

Two pulses from AlienVault OTX paint a stark picture of nation-state threat activity across two distinct theaters: Kimsuky conducting spear-phishing campaigns against South Korean entities with XenoRAT payloads, and FrostyNeighbor (UNC1151/PUSHCHA) executing a destructive VBScript wiper attack against Ukrainian manufacturing infrastructure. These campaigns represent the full spectrum of APT operations — espionage and destruction — and require immediate detection engineering response.

Threat Summary

The OTX pulse data reveals two concurrent nation-state operations with distinct objectives and TTPs:

Kimsuky (North Korea-attributed) is conducting sustained spear-phishing operations against South Korean targets using a multi-stage delivery chain. The attack begins with malicious LNK files containing embedded PowerShell scripts, followed by HTA file retrieval via curl.exe, and ultimately deploying XenoRAT — a .NET-based remote access trojan with keylogging and information stealing capabilities. The campaign utilizes AutoIt scripts and Windows Task Scheduler for persistence. Five distinct attack variants (Type A through D plus Unknown) were classified, indicating an adaptive adversary refining their intrusion methodology.

FrostyNeighbor (Belarus-aligned, tracked as UNC1151/PUSHCHA/Storm-0257/TA445) executed the first documented destructive wiper attack attributed to Belarusian threat actors against Ukrainian infrastructure. The group leveraged Chisel for tunneling, UltraVNC for remote access, and Cobalt Strike for post-exploitation before deploying a VBScript-based wiper through Group Policy Objects. This represents a significant escalation from traditional espionage to destructive operations against manufacturing and transportation sectors.

Threat Actor / Malware Profile

Kimsuky — XenoRAT Campaign

Distribution Method: Spear-phishing emails delivering malicious LNK files with embedded PowerShell commands. Secondary payloads retrieved via curl.exe fetching HTA files from attacker-controlled infrastructure.

Payload Behavior: XenoRAT is a .NET-based RAT with capabilities including:

Keystroke logging and credential harvesting
Screen capture and webcam access
File exfiltration and system enumeration
Registry manipulation for persistence
Process injection and hollowing

C2 Communication: XenoRAT communicates with C2 servers over HTTP/HTTPS, using encoded POST requests for data exfiltration. The campaign utilized hostnames lutkdd.corpsecs.com and qykvdz.corpsecs.com for command and control.

Persistence Mechanism: Windows Task Scheduler entries with randomized task names, registry Run key modifications, and AutoIt script compilation for obfuscated execution.

Anti-Analysis Techniques: LNK file obfuscation, PowerShell Base64 encoding, AutoIt script packing, and DLL sideloading via legitimate system binaries.

FrostyNeighbor — Destructive Wiper Campaign

Distribution Method: Initial access via spear-phishing or exploitation of internet-facing services, followed by lateral movement using Chisel tunneling and UltraVNC remote access.

Payload Behavior: The VBScript wiper targets:

Master Boot Record (MBR) corruption
File system destruction on fixed and removable drives
Shadow copy deletion to prevent recovery
System file overwrite with junk data

C2 Communication: Cobalt Strike Beacon over HTTPS with malleable C2 profiles mimicking legitimate web traffic. The indicator fried.backyardchickens.top resolved to Cobalt Strike team server infrastructure.

Persistence Mechanism: Group Policy Objects (GPO) modification to deploy the wiper payload across domain-joined systems, registry Run keys, and scheduled tasks with SYSTEM privileges.

Anti-Analysis Techniques: VBScript obfuscation, Cobalt Strike sleep timers to evade sandbox analysis, Chisel tunneling to mask C2 traffic as legitimate HTTP, and timestomping of payload files.

IOC Analysis

The OTX pulses provide hostname-based indicators suitable for DNS-level detection and blocking:

Indicator	Type	Campaign	Severity
lutkdd.corpsecs.com	Hostname	Kimsuky / XenoRAT	High
qykvdz.corpsecs.com	Hostname	Kimsuky / XenoRAT	High
fried.backyardchickens.top	Hostname	FrostyNeighbor / Cobalt Strike	Critical

Operationalization Guidance:

DNS Sinkholing: Add all identified hostnames to enterprise DNS sinkhole or RPZ (Response Policy Zone) configurations. Monitor for resolution attempts as indicators of compromise.

Proxy/SWG Blocking: Implement URL filtering rules at web proxies and Secure Web Gateways. Cobalt Strike infrastructure often uses newly registered domains with suspicious TLDs (e.g., .top).

SIEM Correlation: Ingest IOCs into threat intelligence platforms (MISP, ThreatConnect, Anomali) and correlate with DNS query logs, proxy logs, and NetFlow data.

Tooling:

VirusTotal/OTX: Query indicator reputation and related samples
Shodan/Censys: Identify Cobalt Strike team servers via TLS certificate analysis
Maltego: Pivot on domains to identify associated infrastructure
YARA: Develop rules for XenoRAT and wiper payload signatures

Detection Engineering

YAML

---
title: Kimsuky XenoRAT LNK Execution with Embedded PowerShell
id: 8a7b3c2d-1e4f-5a6b-9c8d-7e2f1a3b5c6d
status: experimental
description: Detects execution of LNK files containing embedded PowerShell commands, characteristic of Kimsuky spear-phishing campaigns delivering XenoRAT
author: Security Arsenal Threat Intelligence
date: 2026/11/02
references:
    - https://asec.ahnlab.com/en/96295
logsource:
    category: process_creation
    product: windows
detection:
    selection_lnk:
        ParentImage|endswith: '\explorer.exe'
        CommandLine|contains: '.lnk'
    selection_powershell:
        CommandLine|contains:
            - 'powershell'
            - 'pwsh'
            - '-enc'
            - '-encodedcommand'
            - 'FromBase64String'
    selection_suspicious_paths:
        CommandLine|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\Users\Public\'
    condition: selection_lnk and (selection_powershell or selection_suspicious_paths)
falsepositives:
    - Legitimate administrative scripts with LNK shortcuts
    - Software deployment tools using LNK-based installation
level: high
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.t1059.001
    - attack.t1204.002
---
title: FrostyNeighbor VBScript Wiper Execution via GPO
id: 9b8c4d3e-2f5a-6b7c-0d9e-8f3a2b4c6d7e
status: experimental
description: Detects VBScript execution with wiper characteristics including MBR access, shadow copy deletion, and mass file overwrite operations
author: Security Arsenal Threat Intelligence
date: 2026/11/02
references:
    - https://cyberpress.org/belarus-linked-hackers-deploy-wiper/
logsource:
    category: process_creation
    product: windows
detection:
    selection_vbscript:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    selection_wiper_behavior:
        CommandLine|contains:
            - 'vssadmin'
            - 'delete shadows'
            - 'bcdedit'
            - 'diskpart'
            - '\\.\PhysicalDrive'
            - 'WriteFile'
            - 'CreateFile'
    selection_gpo_paths:
        CommandLine|contains:
            - '\SysVol\'
            - '\Policies\'
            - '\Scripts\'
    condition: selection_vbscript and (selection_wiper_behavior or selection_gpo_paths)
falsepositives:
    - Legitimate administrative VBScript maintenance scripts
    - Backup software utilizing shadow copy deletion
level: critical
tags:
    - attack.impact
    - attack.t1485
    - attack.t1490
    - attack.t1561.002
---
title: Chisel Tunneling or Cobalt Strike C2 Communication
id: 0c9d5e4f-3a6b-7c8d-1e0f-9a4b3c5d7e8f
status: experimental
description: Detects network communication patterns associated with Chisel tunneling and Cobalt Strike Beacon C2, as used by FrostyNeighbor
author: Security Arsenal Threat Intelligence
date: 2026/11/02
references:
    - https://cyberpress.org/belarus-linked-hackers-deploy-wiper/
logsource:
    category: network_connection
    product: windows
detection:
    selection_chisel:
        Image|endswith:
            - '\chisel.exe'
            - '\chisel64.exe'
        CommandLine|contains:
            - 'client'
            - 'server'
            - '--reverse'
            - 'R:'
            - 'socks'
    selection_cobalt_strike:
        DestinationHostname|contains:
            - 'fried.backyardchickens.top'
        DestinationPort:
            - 443
            - 8443
            - 8080
    selection_suspicious_tld:
        DestinationHostname|endswith:
            - '.top'
            - '.xyz'
            - '.club'
            - '.online'
    condition: selection_chisel or (selection_cobalt_strike and selection_suspicious_tld)
falsepositives:
    - Legitimate reverse proxy or tunneling tools in development environments
    - Authorized penetration testing activities
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1572
    - attack.t1090.001

KQL — Microsoft Sentinel / Defender

// Hunt for Kimsuky XenoRAT and FrostyNeighbor wiper indicators and behaviors
let SuspiciousHosts = dynamic(["lutkdd.corpsecs.com", "qykvdz.corpsecs.com", "fried.backyardchickens.top"]);
let TimeRange = 7d;
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(TimeRange)
    | where RemoteUrl in~ (SuspiciousHosts) or RemoteIP in~ (SuspiciousHosts)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, Protocol
    | extend IndicatorType = "NetworkConnection"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(TimeRange)
    | where FileName in~ ("wscript.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "curl.exe", "rundll32.exe")
    | where ProcessCommandLine has_any ("FromBase64String", "-enc", "vssadmin", "delete shadows", "PhysicalDrive", ".lnk", ".hta")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
    | extend IndicatorType = "ProcessExecution"),
    (DeviceRegistryEvents
    | where TimeGenerated > ago(TimeRange)
    | where RegistryKey has_any ("\Run\", "\RunOnce\", "\CurrentVersion\Windows\")
    | where RegistryValueData has_any (".vbs", ".ps1", ".lnk", "powershell", "wscript")
    | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
    | extend IndicatorType = "PersistenceMechanism")
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), EventCount = count() by DeviceName, IndicatorType, InitiatingProcessFileName, FileName, RemoteUrl, ProcessCommandLine
| order by LastSeen desc

PowerShell

# IOC Hunt Script — Kimsuky XenoRAT + FrostyNeighbor Wiper
# Run with elevated privileges on suspected endpoints

$SuspectHosts = @("lutkdd.corpsecs.com", "qykvdz.corpsecs.com", "fried.backyardchickens.top")
$ReportPath = "$env:TEMP\ThreatHunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').json"
$Findings = @()

Write-Host "[+] Starting IOC Hunt — $(Get-Date)" -ForegroundColor Cyan

# Check DNS cache for suspicious hostnames
Write-Host "[*] Checking DNS cache..." -ForegroundColor Yellow
$DnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($Entry in $DnsCache) {
    foreach ($Host in $SuspectHosts) {
        if ($Entry.Name -like "*$Host*") {
            $Findings += [PSCustomObject]@{
                Type = "DNSCache"
                Indicator = $Entry.Name
                Data = $Entry.Data
                Severity = "High"
                Timestamp = Get-Date
            }
        }
    }
}

# Check active network connections
Write-Host "[*] Checking network connections..." -ForegroundColor Yellow
$NetConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($Conn in $NetConnections) {
    try {
        $Resolved = [System.Net.Dns]::GetHostEntry($Conn.RemoteAddress).HostName
        foreach ($Host in $SuspectHosts) {
            if ($Resolved -like "*$Host*") {
                $Findings += [PSCustomObject]@{
                    Type = "NetworkConnection"
                    Indicator = $Resolved
                    RemoteIP = $Conn.RemoteAddress
                    RemotePort = $Conn.RemotePort
                    OwningProcess = (Get-Process -Id $Conn.OwningProcess -ErrorAction SilentlyContinue).ProcessName
                    Severity = "Critical"
                    Timestamp = Get-Date
                }
            }
        }
    } catch {}
}

# Check scheduled tasks for persistence
Write-Host "[*] Checking scheduled tasks..." -ForegroundColor Yellow
$Tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {$_.TaskPath -notlike "\Microsoft*"}
foreach ($Task in $Tasks) {
    $TaskInfo = Get-ScheduledTaskInfo -TaskName $Task.TaskName -TaskPath $Task.TaskPath -ErrorAction SilentlyContinue
    $TaskXml = Export-ScheduledTask -TaskName $Task.TaskName -TaskPath $Task.TaskPath -ErrorAction SilentlyContinue
    if ($TaskXml -match "powershell|wscript|cscript|\.vbs|\.ps1|FromBase64String") {
        $Findings += [PSCustomObject]@{
            Type = "ScheduledTask"
            TaskName = $Task.TaskName
            TaskPath = $Task.TaskPath
            LastRunTime = $TaskInfo.LastRunTime
            Severity = "High"
            Timestamp = Get-Date
        }
    }
}

# Check registry Run keys
Write-Host "[*] Checking registry Run keys..." -ForegroundColor Yellow
$RunKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($KeyPath in $RunKeys) {
    if (Test-Path $KeyPath) {
        $KeyValues = Get-ItemProperty -Path $KeyPath -ErrorAction SilentlyContinue
        foreach ($Property in $KeyValues.PSObject.Properties) {
            if ($Property.Value -match "powershell|wscript|\.vbs|\.ps1|\.lnk|Temp|AppData") {
                $Findings += [PSCustomObject]@{
                    Type = "RegistryPersistence"
                    KeyPath = $KeyPath
                    ValueName = $Property.Name
                    ValueData = $Property.Value
                    Severity = "High"
                    Timestamp = Get-Date
                }
            }
        }
    }
}

# Check for recently modified VBS/PS1/LNK files in user directories
Write-Host "[*] Checking for suspicious script files..." -ForegroundColor Yellow
$UserPaths = @("$env:USERPROFILE\AppData", "$env:USERPROFILE\Downloads", "$env:PUBLIC")
foreach ($Path in $UserPaths) {
    if (Test-Path $Path) {
        $SuspiciousFiles = Get-ChildItem -Path $Path -Recurse -Include "*.vbs", "*.ps1", "*.lnk", "*.hta" -ErrorAction SilentlyContinue | 
            Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)}
        foreach ($File in $SuspiciousFiles) {
            $Findings += [PSCustomObject]@{
                Type = "SuspiciousFile"
                FilePath = $File.FullName
                FileSize = $File.Length
                LastWriteTime = $File.LastWriteTime
                Severity = "Medium"
                Timestamp = Get-Date
            }
        }
    }
}

# Output results
if ($Findings.Count -gt 0) {
    Write-Host "[!] Found $($Findings.Count) potential indicators" -ForegroundColor Red
    $Findings | ConvertTo-Json -Depth 3 | Out-File -FilePath $ReportPath
    Write-Host "[+] Report saved to: $ReportPath" -ForegroundColor Green
    $Findings | Format-Table -AutoSize
} else {
    Write-Host "[+] No indicators found" -ForegroundColor Green
}

Write-Host "[+] Hunt complete — $(Get-Date)" -ForegroundColor Cyan

Response Priorities

Immediate (0-4 hours)

Block IOCs at DNS/Proxy: Add lutkdd.corpsecs.com, qykvdz.corpsecs.com, and fried.backyardchickens.top to DNS sinkhole and proxy blocklists
Hunt for Execution Artifacts: Deploy Sigma rules and KQL queries across EDR and SIEM platforms; search for LNK file execution with embedded PowerShell, VBScript execution from GPO paths, and Chisel tunneling processes
Isolate Suspected Systems: Quarantine any endpoints with confirmed network connections to identified C2 infrastructure

24 Hours

Credential Rotation: If XenoRAT keylogging activity is confirmed, force password resets for all users on affected systems and review authentication logs for lateral movement
Memory Forensics: Capture memory images from compromised hosts to extract XenoRAT configuration and Cobalt Strike Beacon payloads
Email Security Review: Audit email gateway logs for spear-phishing messages matching Kimsuky TTPs; identify additional targeted users

1 Week

GPO Hardening: Implement Group Policy restrictions on VBScript execution (wscript.exe, cscript.exe) via AppLocker or Windows Defender Application Control
PowerShell Logging: Enable PowerShell Script Block Logging and Module Logging across all endpoints; forward to centralized SIEM
LNK File Restrictions: Deploy attack surface reduction rules to block LNK files from executing from user-writable directories
Network Segmentation: Review and enforce network segmentation between manufacturing/OT environments and corporate IT to limit wiper propagation

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Kimsuky XenoRAT + FrostyNeighbor Wiper Campaign: OTX Pulse Analysis — Enterprise Detection Pack