Kimsuky keeps picking RDP, which puts detection on configuration instead of files

RDP Wrapper exists to make Terminal Services answer on a Windows build that was not sold with it, so the detectable event is not a file but a host whose remote-desktop service is running when its own baseline says it should not be ^[1]. The account work has the same shape: a local account that appears on the box but not in inventory, and a session count above one on a machine that has a single user ^[2]. RevClient adds a network-side delta to that list, since its jobs are creating users and switching on port forwarding when told to over C&C ^[9].

Notice how narrowly the custom code is scoped. Of the five remote-control mechanisms AhnLab names in this group's history, four are software an organisation either ships already or can download without a warning ^[14]. What stays bespoke is the small stuff that bends the sanctioned channel rather than replacing it: concealing the added account, allowing concurrent sessions, opening the forward ^[2][9]. The Chrome Remote Desktop cases push this further, because a session carried by the browser's own service does not present as an unusual listener at all ^[8]; the evidence lives on the host, in who was logged on and how many of them there were.

The execution path repeats the pattern. pow.ps1 decrypts a data file under %APPDATA%\Microsoft, runs it in memory, and the resulting injector places the final payload inside MSBuild.exe, a legitimate Microsoft program ^[4]. The first-stage batch file, for its part, enumerates installed antivirus products using WMIC before pulling down script-type malware ^[10]. The keylogger is a PowerShell file writing to %APPDATA%\k.log, launched by a VBScript named after OneNote ^[11].

Two things in the writeup say plainly that indicator lists will not hold. BabyShark's C&C address changed part way through, which AhnLab reads as the operator updating the implant after installation ^[12], and the intrusion continued with malware and server addresses being swapped as it went ^[13]. Meanwhile the PDB data on the RDP tooling suggests recent compilation of features already seen in earlier cases ^[3]. The behaviour is old, the binaries are new, and the addresses are disposable.

What does not rotate is the target set and the working method: spear phishing into defence, diplomatic and academic bodies, with the goal of taking internal information and technology out ^[6]. A group that has been at this since 2013 ^[5] has had a long time to learn which detections those targets actually run. The durable signals are unglamorous ones, and they are all about the state of sanctioned software: remote-desktop services enabled against policy, local account deltas, more sessions than users, and forwarded ports on machines that have no business forwarding anything.