ATT&CK ReferencesEnkiWhiteHat_KimsukyDOCSWAP_Dec2025

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025

EnkiWhiteHat. (2025, December 16). Kimsuky Distributing Malicious Mobile App via QR Code. Retrieved January 8, 2026.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1036.005 Match Legitimate Resource Name or Location	GroupKimsuky	Kimsuky has renamed malware to legitimate names such as `ESTCommon.dll` or `patch.dll`. Kimsuky has also disguised payloads using legitimate file names including a PowerShell payload named chrome.ps1. Kimsuky has also used a malicious QR code that masqueraded as a legitimate package delivery service. EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 Kimsuky Malwarebytes Securonix Kimsuky February 2025
T1598.003 Spearphishing Link	GroupKimsuky	Kimsuky has used links in e-mail to steal account information including web beacons for target profiling. Kimsuky has also utilized QR codes (also known as Quishing) to direct victims to malicious links through the reliance of a mobile device to scan a code with an embedded malicious URL. EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 FBI_KimsukyQR_Jan2026 KISA Operation Muzabi Malwarebytes Kimsuky June 2021 Proofpoint TA427 April 2024 VirusBulletin Kimsuky October 2019

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.