1. Overview

 AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which the Kimsuky group ultimately distributed the Funhouse ransomware via a malicious Hangul document that was disguised as a resume. The Funhouse ransomware was identified as a variant of previously disclosed endpoint ransomware, and the tools used in this attack—such as Quasar RAT—as well as the overall attack chain shared numerous similarities with Kimsuky’s endpoint ransomware distribution cases observed since the first half of 2026. In this blog post, we analyze the recently identified Funhouse ransomware distribution campaign and summarize its connections to Kimsuky’s previous Endpoint ransomware distribution campaigns.

 

[Figure 1] Decoy document used in the attack

 

2. Initial Breach

 The “resume.Hwp” file used for the Initial Breach contains embedded malicious OLE data. When this HWP document is executed, the Hangul process creates the files “pdf.Exe” and “pdf.Exe.Manifest”—which are contained within the OLE object—in the %TEMP% path without any user interaction. Pdf.Exe is a VbsEdit script executor, and pdf.Exe.Manifest is a malicious script that creates a file named lpe{random value}.Bat in the %TEMP% path. Additionally, the document contains a hyperlink prompting the user to open a file named resume_{name}.Pdf; when the user clicks this link, the pdf.Exe file created in the %TEMP% path executes pdf.Exe.Manifest, triggering subsequent malicious behaviors. Meanwhile, the VbsEdit script executor (pdf.Exe) used in this case was previously exploited in the same manner in a Kimsuky-related malware distribution case covered in our past TI content, as shown in [Figure 4].

 

[Figure 2] Malicious HWP file

 

[Figure 3] Malicious file created in the %TEMP% path

 

[Figure 4] ms.Exe and ms.Exe.Manifest files from a previous malware distribution case

 

3. Funhouse Ransomware Infection Chain

 Following the execution of the malicious HWP document, a multi-stage attack chain was identified in which multiple scripts, including Batch, VBS, and PowerShell, were executed sequentially. As part of this attack flow, Quasar RAT was installed and subsequently used to deploy the Funhouse ransomware. Further details regarding the overall attack chain can be found in our TI report, From “From Endpoint to Funhouse: Evolution of Ransomware Families and Kimsuky-Linked Distribution Cases.”

 

Funhouse Ransomware Infection Chain
Resume.hwp Execution ↓ Multi-Stage Script Execution (Batch, VBS, PowerShell, etc.)   ↓ Python-Based Backdoor Deployment ↓ Quasar RAT Installation ↓ Funhouse Ransomware Execution

[Table 1] Overall Execution Flow

 

4. Comparison with Past Kimsuky Cases

4.1 Batch Script

 The Batch file used in this campaign shared several code characteristics with the Batch file analyzed in the previously published report, “Changes in Malicious LNK Files and Distribution Methods for Python-Based Backdoors (the Kimsuky group).” The file was periodically updated by the threat actor and served as a supplementary persistence mechanism throughout the attack.

 

BAT files from past attack cases	BAT file from the current attack case

[Figure 5] Similar batch file code

 

4.2 Quasar RAT

 The Quasar RAT, which executes the final ransomware, was identified as a variant of the Quasar RAT previously observed in Endpoint ransomware distribution cases. Like previous cases, this sample uses a configuration file with the .Dwg file extension; this configuration file stores information such as the C2 address, the target identification value (TAG), and the mutex name. Notably, the mutex name used is identical to that in previous cases; a detailed comparison is shown in [Table 2].

 

Case	Endpoint Ransomware Case (February 2026)	Endpoint Ransomware Case (June 2026)	Funhouse Ransomware Case (September 2026)
File name	se.dwg	se.dwg	dog.dwg
VERSION	1.1.8	1.1.8	4.4.3
HOSTS	45.95.186[.]232:80	45.43.60[.]53:80	70.36.97[.]236:443
TAG	{Specific Identifier}	{Name of Company Damaged}	{Name of Company Damaged}_it1
MUTEX	_QQ_XCZ_VCXZ	_QQ_XCZ_VCXZ	_QQ_XCZ_VCXZ

[Table 2] Comparison of Quasar RAT configuration files

 

4.3 Ransomware: From Endpoint to Funhouse

 The Funhouse ransomware, which is executed in the final stage, has been identified as a variant of the previously disclosed Endpoint ransomware. This Funhouse ransomware uses the same encryption extension, ransom note file name, mutex, key generation and encryption methods, encryption footer size, and watermarks as the Endpoint ransomware identified in June. However, the threat actor’s contact information was found to be different; detailed comparisons are shown in [Table 3] and [Figure 6].

 

Case	Endpoint Ransomware Case (February 2026)	Endpoint Ransomware Case (June 2026)	Funhouse Ransomware Case (September 2026)
Encryption extension	.Endpoint	.Funhouse	.Funhouse
Ransom note	How To Restore Your Files.Txt	How To Restore Your Files.Txt	How To Restore Your Files.Txt
Mutex	Mutexisfunnylocal	DoYouWantToHaveSexWithCuongDong	DoYouWantToHaveSexWithCuongDong
Contact	Schipkealfred@gmail.Com	FunhouseRaaS@proton.Me	Funhouse8764@tutamail.Com
Key Generation Method	Random Number + SHA-256	CryptGenRandom + Curve25519 + SHA-512	CryptGenRandom + Curve25519 + SHA-512
Encryption method	ChaCha20	HC-128	HC-128
Encryption Footer	1,592 Bytes (Normal Mode)	72 Bytes	72 Bytes
Footer marker	X	Choung Dong looks like a hot dog!!	Choung Dong looks like a hot dog!!

[Table 3] Ransomware Comparison

 

EndPoint Ransomware Case (February 2026)	EndPoint ransomware case (June 2026)	Funhouse Ransomware Case (September 2026)

[Figure 6] Ransom note generation code for each ransomware

 

5. Conclusion

 This Funhouse ransomware distribution case exhibited an attack chain similar to the Endpoint ransomware distribution cases by the Kimsuky group observed since the first half of 2026, including the execution of the ransomware via Quasar RAT through a multi-stage script. It was confirmed that Quasar RAT and Funhouse ransomware have continuously updated their attack infrastructure and tools—such as by changing versions, C2 addresses, identifying information, and threat actor contact details—while retaining the key characteristics of their existing families.

Meanwhile, a shift was also observed, with the Kimsuky group utilizing hwp documents as the initial delivery vector instead of the LNK files they had primarily used recently. This is presumed to be an attempt to lower users’ suspicion by disguising a familiar document format as a resume and to increase the likelihood of a successful attack by enticing users to click on links within the document. In fact, in this case, malicious behavior is executed only after the user clicks a link within the document; therefore, extreme caution is required when viewing such documents. 

Users should verify the source and credibility of hyperlinks included in work-related documents, such as resumes, and refrain from accessing suspicious links. Additionally, they should apply the latest security patches to software—including Hangul—and operating systems, and keep V3 updated to the latest version to prevent Malware infections.

MD5

17d97e3ee3185d82812a4014444c36f3

327617e977eefd15708568f43140e595

3d802ceaf891ea57ecd7d1d786d96a0d

5be7578bfe633fb268ad97a520abb4e1

78c219a6bec5fc30f43b62e4934646eb

URL

http[:]//daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/adminer/logo[.]php?au=tt

http[:]//daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/enter/logo[.]php

http[:]//kgbrazing[.]makeway2017[.]gethompy[.]com/skin/board/pym/logo-man[.]php

http[:]//koocpt[.]site/meta/logo[.]php

http[:]//masonparkpg[.]dothome[.]co[.]kr/Gorg04/a/logo-man[.]php

IP

45[.]43[.]60[.]53

45[.]95[.]186[.]232

70[.]36[.]97[.]236