Researchers linked a September case to two earlier incidents in February and June through matching settings in the attackers' tools.

 

What happened

Kimsuky, a North Korean state-backed hacking group, used a document disguised as a job application to install ransomware called Funhouse, Cyber Security News reported on October 13, 2026. Researchers published the analysis on October 1. The file, named resume.Hwp, was made in Hangul Word Processor, a word processing program widely used in South Korea. Opening it quietly dropped two files into a temporary Windows folder. A link inside the résumé invited the reader to open a PDF bearing a person's name. Clicking it started the attack. The report does not say how many victims there were. In this instance, the résumé was a phishing lure directed at whoever handles job applications.

 

Going deeper

The attack ran through several stages before any files were locked. A series of scripts deployed, one after another. A backdoor written in Python followed. Then came Quasar, a remote access tool, which the attackers used to deploy the ransomware. Researchers tied the case to February and June incidents involving ransomware called Endpoint. Quasar's settings file used the same internal name across all three. The June and September ransomware samples shared the same file extension, ransom note filename, and encryption method. Funhouse appears to be a later version of Endpoint. The September case used a newer version of Quasar than the earlier ones.

 

What was said

Researchers said the move from Windows shortcut files, which the group had favoured recently, to word processing documents was likely meant to lower suspicion, Cyber Security News reported. A résumé is a normal work item, especially for staff who handle applications. Their advice covers checking links and senders in documents, avoiding suspicious links, and keeping word processing software, operating systems, and endpoint protection up to date.

 

In the know

Kimsuky has most likely been operating since 2012 and gathers intelligence for the North Korean government, according to a joint advisory from CISA, the FBI, and US Cyber Command. Spearphishing with a malicious attachment is its most observed method of getting in. The advisory says the group tailors its lures to its targets, with topics including COVID-19, North Korea's nuclear program, and media interview requests. Once inside, it has set up rules in victims' email accounts that automatically forward their messages. In January 2026 the FBI warned that the group was putting malicious QR codes into spearphishing emails sent to think tanks, universities, and government bodies, in an FBI alert. Ransomware is a newer addition to a group better known for spying.

 

The big picture

Hiring is constant in healthcare, which puts résumé lures in front of a large number of staff. Health care and social assistance employers had 1.36 million open positions in August 2026, according to the Bureau of Labor Statistics. Recruiters and hiring managers open attachments from strangers as a normal part of the job. That's the gap this lure is built for. The CISA advisory also gives a specific thing to check in email. Kimsuky has set up automatic forwarding rules in compromised mailboxes, so an unexpected rule sending mail outside the organization is worth investigating. In a hospital mailbox, those forwarded messages can carry patient information. Asking applicants to submit through an application portal, rather than by emailing attachments, cuts down how many unknown files reach staff inboxes at all.

 

FAQs

What is a remote access tool?

Software that lets someone control a computer from elsewhere. Legitimate versions are used by IT teams. Attackers use them to move around a network and install other malware.

 

Why would a spying group use ransomware?

The research doesn't explain the motive. Ransomware can raise money, and it can also cover up or distract from data theft.

 

Is this a risk for organizations that don't use Hangul Word Processor?

The specific file type matters less than the method. The same approach works with any document format that can carry embedded files and links.

 

What should hiring staff do with unexpected résumé attachments?

Treat them as untrusted. Open them in a protected viewing mode where possible, avoid clicking links inside them, and report anything that asks to open another file or install software.

 

How can an organization spot forwarding rules set up by attackers?

Review mailbox rules for any that forward mail to outside addresses, especially ones created recently or with vague names. Many email platforms can alert on new external forwarding rules.