1. Overview

 AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which the Kimsuky group ultimately distributed the Funhouse ransomware via a malicious Hangul document that was disguised as a resume. The Funhouse ransomware was identified as a variant of previously disclosed endpoint ransomware, and the tools used in this attack—such as Quasar RAT—as well as the overall attack chain shared numerous similarities with Kimsuky’s endpoint ransomware distribution cases observed since the first half of 2026. In this blog post, we analyze the recently identified Funhouse ransomware distribution campaign and summarize its connections to Kimsuky’s previous Endpoint ransomware distribution campaigns.

 

[Figure 1] Decoy document used in the attack

 

2. Initial Breach

 The “resume.Hwp” file used for the Initial Breach contains embedded malicious OLE data. When this HWP document is executed, the Hangul process creates the files “pdf.Exe” and “pdf.Exe.Manifest”—which are contained within the OLE object—in the %TEMP% path without any user interaction. Pdf.Exe is a VbsEdit script executor, and pdf.Exe.Manifest is a malicious script that creates a file named lpe{random value}.Bat in the %TEMP% path. Additionally, the document contains a hyperlink prompting the user to open a file named resume_{name}.Pdf; when the user clicks this link, the pdf.Exe file created in the %TEMP% path executes pdf.Exe.Manifest, triggering subsequent malicious behaviors. Meanwhile, the VbsEdit script executor (pdf.Exe) used in this case was previously exploited in the same manner in a Kimsuky-related malware distribution case covered in our past TI content, as shown in [Figure 4].

 

[Figure 2] Malicious HWP file

 

[Figure 3] Malicious file created in the %TEMP% path

 

[Figure 4] ms.Exe and ms.Exe.Manifest files from a previous malware distribution case

 

3. Funhouse Ransomware Infection Chain

 As shown in [Table 1], a multi-stage attack flow was identified in which, after the malicious hwp document was executed, multiple scripts—including Batch, VBS, and PowerShell—were executed sequentially. During this attack process, the Quasar RAT was installed, and the threat actor ultimately used it to execute the Funhouse ransomware. Although it was not possible to determine detailed functionality at the time of analysis due to the unavailability of some files, we identified the relationships between the creation and execution of each file and determined the overall execution sequence through our own log analysis.

 

Execution Sequence	File name	Function
1	Resume.Hwp	Drop and run lpe_75285.Bat
2	Lpe_75285.Bat	Run Decoy (Resume_{Name}.Pdf) https://{Google Drive Link} Download %TEMP%\b7a093f.Bat hxxp://pygrab[.]Xyz/bing/wspkg/logo.Php?Au=init
3	B7a093f.Bat	Download C:\wincc\dl.Zip hxxp://koocpt[.]Site/totor/logo.Php?Au=text
4	Dl.Zip	Contains ch.Bat and poef0od.Vbs
5	Poef0od.Vbs	Run C:\wincc\ch.Bat
6	Ch.Bat	Download C:\winxx\up.Bat  hxxp://daejin.Makeway2017.Gethompy[.]Com/lib/Cache/adminer/logo.Php?Au=tt
7	Up.Bat	Download %TEMP%\TMPGo80944.Zip hxxp://toyless[.]Shop/pym/logo-man.Php?Gold=python314
8	Tmpgo80944.Zip	Portable Python-based backdoor
9	_Pydebug.Pyc	Tmpgo80944.Zip My compiled backdoor code
10	Uac41.Ps1	UAC bypass and execution of C:\temp\1.Bat
11	1.Bat	Unverified
12	1.Vbs	Scheduled to run; executes C:\Themes\fox.Ps1
13	Fox.Ps1	Loads C:\Themes\1s5t45.Bmp
14	1S5t45.Bmp	Inject 2serges.Bmp into msbuild.Exe
15	2Serges.Bmp	Quasar RAT using dog.Dwg as a configuration file
16	RuntimeBroker.Exe	EndPoint ransomware variant: Funhouse ransomware

[Table 1] Overall Execution Flow

 

4. Comparison with Past Kimsuky Cases

4.1 Batch Script

 The up.Bat file used in this case exhibited code characteristics similar to the batch script identified in the previously disclosed “Changes in Malicious LNK Files and Distribution Methods for Python-Based Backdoors (the Kimsuky group).” The `up.Bat` file is periodically updated by the `ch.Bat` file, and the threat actors utilized it as an auxiliary means to maintain persistence.

 

BAT files from past attack cases	BAT file from the current attack case

[Figure 5] Similar batch file code

 

4.2 Quasar RAT

 The Quasar RAT, which executes the final ransomware, was identified as a variant of the Quasar RAT previously observed in Endpoint ransomware distribution cases. Like previous cases, this sample uses a configuration file with the .Dwg file extension; this configuration file stores information such as the C2 address, the target identification value (TAG), and the mutex name. Notably, the mutex name used is identical to that in previous cases; a detailed comparison is shown in [Table 2].

 

Case	Endpoint Ransomware Case (February 2026)	Endpoint Ransomware Case (June 2026)	Funhouse Ransomware Case (September 2026)
File name	Se.Dwg	Se.Dwg	Dog.Dwg
VERSION	1.1.8	1.1.8	4.4.3
HOSTS	45.95.186[.]232:80	45.43.60[.]53:80	70.36.97[.]236:443
TAG	{Specific Identifier}	{Name of Company Damaged}	{Name of Company Damaged}_it1
MUTEX	_QQ_XCZ_VCXZ	_QQ_XCZ_VCXZ	_QQ_XCZ_VCXZ

[Table 2] Comparison of Quasar RAT configuration files

 

4.3 Ransomware: From Endpoint to Funhouse

 The Funhouse ransomware, which is executed in the final stage, has been identified as a variant of the previously disclosed Endpoint ransomware. This Funhouse ransomware uses the same encryption extension, ransom note file name, mutex, key generation and encryption methods, encryption footer size, and watermarks as the Endpoint ransomware identified in June. However, the threat actor’s contact information was found to be different; detailed comparisons are shown in [Table 3] and [Figure 6].

 

Case	Endpoint Ransomware Case (February 2026)	Endpoint Ransomware Case (June 2026)	Funhouse Ransomware Case (September 2026)
Encryption extension	.Endpoint	.Funhouse	.Funhouse
Ransom note	How To Restore Your Files.Txt	How To Restore Your Files.Txt	How To Restore Your Files.Txt
Mutex	Mutexisfunnylocal	DoYouWantToHaveSexWithCuongDong	DoYouWantToHaveSexWithCuongDong
Contact	Schipkealfred@gmail.Com	FunhouseRaaS@proton.Me	Funhouse8764@tutamail.Com
Key Generation Method	Random Number + SHA-256	CryptGenRandom + Curve25519 + SHA-512	CryptGenRandom + Curve25519 + SHA-512
Encryption method	ChaCha20	HC-128	HC-128
Encryption Footer	1,592 Bytes (Normal Mode)	72 Bytes	72 Bytes
Footer marker	X	Choung Dong looks like a hot dog!!	Choung Dong looks like a hot dog!!

[Table 3] Ransomware Comparison

 

EndPoint Ransomware Case (February 2026)	EndPoint ransomware case (June 2026)	Funhouse Ransomware Case (September 2026)

[Figure 6] Ransom note generation code for each ransomware

 

5. Conclusion

 This Funhouse ransomware distribution case exhibited an attack chain similar to the Endpoint ransomware distribution cases by the Kimsuky group observed since the first half of 2026, including the execution of the ransomware via Quasar RAT through a multi-stage script. It was confirmed that Quasar RAT and Funhouse ransomware have continuously updated their attack infrastructure and tools—such as by changing versions, C2 addresses, identifying information, and threat actor contact details—while retaining the key characteristics of their existing families.

Meanwhile, a shift was also observed, with the Kimsuky group utilizing hwp documents as the initial delivery vector instead of the LNK files they had primarily used recently. This is presumed to be an attempt to lower users’ suspicion by disguising a familiar document format as a resume and to increase the likelihood of a successful attack by enticing users to click on links within the document. In fact, in this case, malicious behavior is executed only after the user clicks a link within the document; therefore, extreme caution is required when viewing such documents. 

Users should verify the source and credibility of hyperlinks included in work-related documents, such as resumes, and refrain from accessing suspicious links. Additionally, they should apply the latest security patches to software—including Hangul—and operating systems, and keep V3 updated to the latest version to prevent Malware infections.

MD5

17d97e3ee3185d82812a4014444c36f3

327617e977eefd15708568f43140e595

3d802ceaf891ea57ecd7d1d786d96a0d

5be7578bfe633fb268ad97a520abb4e1

78c219a6bec5fc30f43b62e4934646eb

URL

http[:]//daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/adminer/logo[.]php?au=tt

http[:]//daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/enter/logo[.]php

http[:]//kgbrazing[.]makeway2017[.]gethompy[.]com/skin/board/pym/logo-man[.]php

http[:]//koocpt[.]site/meta/logo[.]php

http[:]//masonparkpg[.]dothome[.]co[.]kr/Gorg04/a/logo-man[.]php

IP

45[.]43[.]60[.]53

45[.]95[.]186[.]232

70[.]36[.]97[.]236