⤷ Title: Kimsuky APT Uses JavaScript Loader and Certutil to Achieve Minute-by-Minute Persistence via Windows Scheduled Task
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 10 Nov 2025 00:06:35 +0000
════════════════════════
⌗ Tags: #Malware #APT #Certutil #Espionage #JavaScript Loader #Kimsuky #living_off_the_land #Scheduled Task #Themes.js
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 10 Nov 2025 00:06:35 +0000
════════════════════════
⌗ Tags: #Malware #APT #Certutil #Espionage #JavaScript Loader #Kimsuky #living_off_the_land #Scheduled Task #Themes.js
Daily CyberSecurity
Kimsuky APT Uses JavaScript Loader and Certutil to Achieve Minute-by-Minute Persistence via Windows Scheduled Task
Kimsuky APT is using a Themes.js JavaScript loader and certutil LOLBIN to gain minute-by-minute persistence via a Windows Scheduled Task. The APT is targeting think tanks for espionage.