North Korean Hackers Hide AnyDesk on Victim PCs to Maintain Secret Remote Access

North Korea-linked Kimsuky operators have targeted organizations in South Korea and Japan with spear-phishing campaigns that install and conceal AnyDesk, giving attackers persistent, interactive remote access while blending into legitimate software activity.

The operation combines OneDrive-hosted lures, malicious Windows shortcut files, scheduled-task persistence, PowerShell payloads, and email theft across Thunderbird, Outlook, and Gmail.

The archives carried weaponized LNK files disguised as topical Japanese- and Korean-language documents, including material related to regional events and policy issues.

When a recipient launches the shortcut, it executes a concealed command that opens a decoy PDF while downloading a VBE payload from attacker-controlled infrastructure.

The VBE script reports the victim’s MAC address to the command-and-control server. It executes the PowerShell response directly in memory.

This reduces obvious disk artifacts while allowing the operators to change the next-stage payload at any time.

Persistence is established through a scheduled task named Chrome_Update, configured to execute the VBE loader every 15 minutes.

That polling mechanism effectively turns the victim endpoint into a remotely managed implant: Kimsuky can update scripts on its C2 server and have compromised systems retrieve and run them without deploying a new phishing attachment.

The PowerShell modules collected host reconnaissance data, including installed security products and system details, before encoding and exfiltrating the information. Other scripts targeted locally stored email.

Researchers at ENKI WhiteHat said the activity was observed during the first half of 2026. Victims received phishing emails containing OneDrive sharing links to ZIP archives.

For Thunderbird, the malware accessed mbox archives and extracted recent inbox and sent-mail content into EML files.

AnyDesk on Victim PCs

The Outlook collector harvested messages sent or received since January 1, 2026, separating attachments from message content and storing account-specific data under the public Music directory.

Researchers also found an in-memory keylogger that compiles embedded C# code to hook keyboard input and save keystrokes to %AppData%Microsoftttmp1.log.

The logging component did not include its own exfiltration routine, suggesting a separate PowerShell job uploaded the captured data.

The campaign additionally deployed a malicious Chrome extension designed to intercept Gmail activity.

The extension watched Gmail’s compose and reading interfaces, capturing sender and recipient data, message bodies and attachments before transmitting them to an attacker-controlled server.

A 2023 joint advisory from Germany’s BfV and South Korea’s NIS previously documented Kimsuky’s use of malicious Chromium extensions to steal Gmail contents after victims logged in automatically.

The most concerning element is Kimsuky’s use of legitimate remote-management tools as covert backdoors.

The attackers installed both Chrome Remote Desktop and AnyDesk, creating redundant access paths that antivirus products may not flag because the underlying applications are legitimate.

The AnyDesk deployment relied on files downloaded from campaign infrastructure, including a legitimate AnyDesk executable, PowerShell and VBScript launchers, configuration material, connection data and a task definition.

The scripts registered a scheduled task named User_Feed_Synchronization-{0DDC1BD9-E733-425C-B92B-ABAC149AB11232}, which launched the AnyDesk loader every five minutes.

The loader used a mutex named MyAnyMutexName to prevent duplicate execution, then hid AnyDesk windows, Windows security alerts, the taskbar button and the tray icon.

The result is a remote-access channel that can remain operational without the victim noticing the application is running.

Kimsuky also used fodhelper.exe to bypass User Account Control when installing Chrome Remote Desktop, then bound the remote-access service to attacker-supplied authentication data.

This illustrates a broader operational goal: maintain multiple administration-grade footholds rather than rely solely on custom malware.

ENKI WhiteHat linked the campaign to Kimsuky based on victim geography, overlapping Gmail-theft tradecraft and significant similarity with an earlier 2025 AnyDesk installation chain.

Previous reporting on that activity likewise found Kimsuky using scheduled execution and PowerShell to deploy and hide AnyDesk from users.

Defenders should investigate unexpected scheduled tasks invoking wscript.exe or PowerShell, review Chrome extensions with excessive permissions such as , and identify unauthorized Chrome Remote Desktop or AnyDesk installations.

Organizations should also block or scrutinize OneDrive links received through unsolicited email, monitor use of fodhelper.exe, and alert on AnyDesk processes launched from unusual %AppData% or Public Music paths.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide