Funhouse ransomware has been deployed in a Kimsuky campaign built around a malicious resume document. The September 2026 attack turned a routine job application into a multi-stage route to remote access and file encryption.
AhnLab Security Intelligence Center, known as ASEC, publicly disclosed the campaign on 12 October 2026. Its investigation found that opening the document dropped supporting files, while a separate click on an embedded link activated the malware chain.
How the Funhouse ransomware campaign began
The initial lure was a Hangul Word Processor, or HWP, document disguised as a resume. It contained embedded OLE data and presented a hyperlink that appeared to open a PDF copy named in the format resume_{name}.pdf.
Opening the HWP document caused its process to write two files into the Windows temporary directory: %TEMP%\pdf.exe and %TEMP%\pdf.exe.manifest. This happened without the recipient needing to click the link or approve another visible prompt.
The pdf.exe file was a VbsEdit script runner, while pdf.exe.manifest contained the attacker’s script. However, writing these files was only the preparation stage. The next phase did not begin until the recipient clicked the apparent PDF link inside the resume.
That distinction is important for incident investigations. A user might open the document without completing the entire infection chain, but the two dropped files could still provide evidence that the malicious resume reached and was opened on the device.
The multi-stage execution chain
Clicking the hyperlink caused pdf.exe to process the manifest and begin a sequence involving batch, VBS and PowerShell scripts. A temporary batch file matching %TEMP%\lpe{random}.bat was among the artefacts associated with the activity.
The scripts led to a Python-based backdoor, followed by the installation of Quasar RAT. This remote access trojan gave the attackers a mechanism for controlling the compromised Windows host before Funhouse ransomware was executed as the final stage.
ASEC identified similarities between this process and earlier Kimsuky campaigns that used malicious LNK files and script-based execution to install Python backdoors. The campaign therefore reflects an established delivery approach adapted to a convincing recruitment lure.
Funhouse ransomware and Quasar RAT details
The Quasar RAT installation in the September 2026 case was version 4.4.3. Its configuration was stored in a file named dog.dwg, using a drawing file extension to make the configuration appear less suspicious during a basic review.
The RAT used the mutex _QQ_XCZ_VCXZ, which matched the value identified in earlier Kimsuky cases involving Endpoint ransomware. A mutex is an operating system object that malware can use to prevent duplicate copies from running on the same computer.
ASEC reported 70.36.97.236:443 as an example Quasar RAT command and control address from the Funhouse case. Related Endpoint campaigns used 45.95.186.232:80 and 45.43.60.53:80. Configuration TAG fields also contained identifiers that could distinguish victims.
What happens after ransomware execution
Funhouse ransomware encrypts files and adds the .funhouse extension in recent samples. It creates a ransom note named How To Restore Your Files.txt and has used funhouse8764@tutamail.com as a contact address.
The ransomware also used a mutex named DoYouWantToHaveSexWithCuongDong. ASEC’s comparison identified the same value across Endpoint and Funhouse samples, while Mutexisfunnylocal had appeared in earlier Endpoint activity.
Based on these encryption characteristics, ransom note naming conventions and mutex overlaps, ASEC assessed Funhouse as a variant of Endpoint ransomware. Its earlier technical analysis linked Endpoint to the Babuk code base, placing the latest malware within an existing ransomware lineage rather than treating it as entirely new.
Kimsuky attribution and campaign timeline
ASEC attributed the activity to Kimsuky, a DPRK-linked threat group known for spearphishing and document-based delivery. The assessment was based on technical overlaps, including reused Quasar RAT settings, comparable TAG values, configuration formats and similarities in the script and Python backdoor chain.
- February and June 2026: ASEC observed Kimsuky campaigns delivering Endpoint ransomware, including Quasar RAT configuration details later seen in the Funhouse investigation.
- 1 September 2026: The original Funhouse ransomware incident occurred, with ASEC investigating the wider case during September.
- 12 October 2026: ASEC published its technical findings and linked the operation to previous Endpoint campaigns.
- 13 October 2026: Further security coverage and an Open Threat Exchange pulse repeated the findings and shared a limited set of indicators.
This is confirmed in-the-wild activity, not a proof of concept or a theoretical vulnerability. However, no victim count, affected organisations or targeted sectors were disclosed. The available evidence confirms one analysed distribution case but does not establish the scale of the campaign.
Which systems are exposed to this attack?
The documented chain targets Microsoft Windows systems, as shown by its use of the Windows temporary directory, batch files, VBS, PowerShell and Quasar RAT. No particular Windows version was identified, and the reporting did not describe exploitation of a Windows vulnerability.
Likewise, no specific version of Hangul Word Processor was listed as vulnerable. The attack abused embedded OLE content and relied on the recipient clicking a hyperlink. There is therefore no vendor patch that directly resolves this campaign.
HWP files are most commonly used in South Korea, but the underlying method is transferable to Word documents, PDFs and other job application formats. Recruitment teams, shared HR mailboxes and employees processing unsolicited CVs are the most likely points of exposure to comparable lures.
What organisations should do now
Organisations should focus on the specific document, script and network behaviours revealed by this Funhouse ransomware investigation.
- Search endpoints for pdf.exe, pdf.exe.manifest, dog.dwg and randomly named lpe batch files in the Windows temporary directory.
- Check security logs for unusual chains in which a document process leads to VBS, batch, PowerShell or Python execution.
- Review network records for connections to the reported Quasar RAT command and control addresses, while recognising that attackers can change infrastructure.
- Investigate the _QQ_XCZ_VCXZ mutex, the reported ransomware mutexes, .funhouse files and the How To Restore Your Files.txt ransom note.
- Configure recruitment workflows to isolate unsolicited documents and block or inspect embedded links before files reach everyday user devices.
The two-step nature of the lure should guide incident response. Finding the dropped files may indicate that the document was opened, while subsequent script execution, Quasar RAT traffic or ransomware artefacts would show that the embedded link was also activated.
Originally reported by cybersecuritynews.com.
