We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerShell Keylogger

Researchers recovered the full, live Kimsuky (APT43) CHM malware kill chain—including all payload source code, keylogger, and exfiltration mechanisms—by exploiting an exposed C2 server, mapping 79+ domains, and linking this campaign to broader North Korean credential phishing infrastructure targeting South Korean users.