2026-05-26상세분석보고서KimjongRAT변종_정보탈취에서원격접근확보로의확장.pdf (972 KB)

Hauri identified a new KimjongRAT variant related to malware previously disguised as a tax notice. The variant preserves earlier information-stealing behavior but expands collection to Telegram and Discord data, indicating broader targeting of user communications and credentials. As in the earlier version, execution changes depending on firewall status, with PE or script execution selected according to the environment. The final stage installs a MeshCentral-based agent to obtain remote access, showing a move from standalone data theft toward persistent hands-on system control. The added collection scope, activation of previously dormant functions, and abuse of an RMM tool indicate continued development of KimjongRAT for both theft and remote access.