SYMBOLCOMMON_NAMEaka. SYNONYMS
ps1.randomquery (Back to overview)

RandomQuery

Actor(s): Kimsuky

A set of powershell scripts, using services like Google Docs and Dropbox as C2.

References
2026-04-11 ⋅ Breakglass Intelligence ⋅ Breakglass Intelligence
We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerShell Keylogger
RandomQuery RandomQuery
2025-09-09 ⋅ S2W Inc. ⋅ S2W TALON
Kimsuky’s Use of GitHub for Malware Delivery and Exfiltration
RandomQuery
2025-02-13 ⋅ Securonix ⋅ Den Iyzvyk, Tim Peck
Analyzing DEEP#DRIVE: North Korean Threat Actors Observed Exploiting Trusted Platforms for Targeted Attacks
RandomQuery
2024-03-18 ⋅ Securonix ⋅ Den Iyzvyk, Oleg Kolesnikov, Tim Peck
Analysis of New DEEP#GOSU Attack Campaign Likely Associated with North Korean Kimsuky Targeting Victims with Stealthy Malware
RandomQuery

There is no Yara-Signature yet.