Kimsuky Is Sending Fake Resumes That End In Funhouse Ransomware

Nothing says “hire me” like a Hangul resume that drops Quasar RAT and encrypts your shares with a .Funhouse extension. AhnLab tied the chain to earlier Endpoint ransomware cases. HR inboxes are now an initial access broker. Update your hiring process, or at least stop double-clicking mystery PDFs inside job applications.

ASEC (AhnLab Security intelligence Center) published on the Funhouse delivery case around October 1, 2026, with wider coverage hitting October 13. The lure is resume.Hwp, a Hangul Word Processor document with embedded OLE data. Opening it quietly extracts pdf.Exe and pdf.Exe.Manifest into %TEMP%. The encryption does not start on open. The victim still has to click a hyperlink inside the resume that pretends to open a personalized PDF. That click runs the extracted VbsEdit executor, which starts the script chain.

The chain (short version)

1. Open malicious HWP resume, OLE drops pdf.Exe plus manifest into temp
2. Click decoy PDF link, executor runs manifest, random lpe*.Bat
3. Batch to VBS to PowerShell to Python backdoor
4. Quasar RAT v4.4.3 (config file dog.dwg, C2 70.36.97.236:443 in the September case)
5. Quasar launches Funhouse via RuntimeBroker.exe cover
6. Files encrypted with .Funhouse extension, note How To Restore Your Files.Txt

ASEC links this to Kimsuky activity through shared batch code patterns, a stable Quasar mutex (_QQ_XCZ_VCXZ) across February, June, and September cases, and ransomware traits that match the Endpoint family (HC-128, 72-byte footer, shared mutex and note name between June Endpoint and September Funhouse). Contact mail on the September sample: [email protected]. Treat that as an IOC, not a pen pal.

Why the HWP shift matters

Kimsuky has leaned on LNK and document lures before. Moving to Hangul resumes targets environments where HWP is normal (Korean business and government workflows) and where a “job application” is something humans are trained to open. Recruiter phishing is not new for this actor. Weaponizing the resume format just lowers the suspicion score on the first click.

Public reporting does not give a clean victim count. Do not wait for one. If you handle Korean-language documents or run talent pipelines that accept HWP, you are in the plausible blast radius.

What to do Monday morning

1. Block or sandbox HWP from the internet at the mail gateway if you do not need it. If you do need it, detonate in a VM, not on the HR laptop.
2. Alert on Hangul spawning executables in temp, on *.dwg configs next to RATs, and on the Quasar mutex _QQ_XCZ_VCXZ.
3. Hunt ASEC’s published MD5s and the listed C2 URLs/IPs in your TIP. Defang in tickets. Re-fang only in the lab.
4. If you see .Funhouse or the restore note filename, isolate and assume Quasar was present before encryption.
5. Tell recruiting: never click “view PDF” links inside unsolicited resumes. Ask for PDF/DOCX through the ATS instead.

Sloth take

Nation-state-adjacent actors using job applications as loaders is peak 2026. We automated recruiting and forgot to automate suspicion. Funhouse is Endpoint ransomware in a party hat. The hat is new. The HC-128 and the fake resume energy are not. Patch Hangul, filter the file types you do not need, and stop letting HR be your DMZ.

Need a grown-up to look at your edge stack? Book a slot with Dark Edge Consulting. We do the boring, careful work so you can go back to ignoring your inbox.

Sources

• Cyber Security News, Kimsuky Funhouse resume campaign (2026-10-13): cybersecuritynews.com
• ASEC / AhnLab reporting on Funhouse and Endpoint lineage (report referenced Oct 1, 2026)
• OTX pulse, Funhouse / Kimsuky distribution (2026-10-12)
• GBHackers, Funhouse via Quasar multi-stage scripts: gbhackers.com