State-aligned North Korean operators have been leaning heavily on PowerShell and fileless techniques to perform detailed machine reconnaissance against South Korean targets. These campaigns are less about immediate destruction and more about quietly mapping a victim environment, identifying defensive tooling, and harvesting the system facts needed to weaponize tailored follow-on attacks.

The delivery chains are pragmatic and built to evade casual inspection. Observed vectors include spear-phishing with archive attachments, Compiled HTML Help files bundled inside ISO or ZIP containers, Windows shortcut files that hide PowerShell invocations, and macro-enabled documents hosted on cloud services. Attackers use these containers to drop scripts that decode and run in-memory payloads or call living-off-the-land utilities such as certutil to reconstruct encoded scripts, then execute PowerShell to continue the chain. Rapid7 documented this CHM to PowerShell flow in campaigns attributed to Kimsuky and related clusters.

How the machine reconnaissance works in practice is straightforward and effective. Initial scripts enumerate host details such as OS version, architecture, installed software, running processes, disk and network configuration, connected batteries on laptops, and other environmental indicators. Recon components also probe for endpoint detection and response products by checking running processes and service names. Some recon tools collect browser data and credential material when available, compress and Base64 encode the results, and exfiltrate them directly to attacker-controlled servers via HTTP POST calls or through legitimate cloud storage channels. SentinelOne’s ReconShark analysis shows this exact pattern of checking for security products and exfiltrating recon data without persisting large artifacts to disk.

PowerShell is central because it allows robust discovery and flexible remote retrieval without writing obvious binaries to disk. In other North Korea linked operations, Microsoft observed post-exploitation activity that used PowerShell to download payloads after initial compromise, create user accounts, and run system discovery commands such as tasklist, ipconfig, and systeminfo to build a picture of a target environment. These commands and scripted actions are the same building blocks defenders should monitor for when hunting fileless intrusion behavior.

The operational logic behind machine recon is tactical prudence. By fingerprinting security products and host posture, actors can choose payloads and techniques that bypass or subvert defenses, or they can pick high value systems for credential harvesting and lateral movement. Recent intelligence assessments note that some DPRK operators have broadened their goals to include both intelligence collection and financially motivated activity, making careful reconnaissance an essential step in a wider campaign lifecycle.

Detection and response priorities are clear. First, treat CHM, LNK, and other uncommon archive types as high risk unless explicitly required and scanned. Rapid7’s telemetry shows CHM files remain a viable vector because they blend help content and embedded script. Second, hunt for obfuscated PowerShell usage such as long Base64 blobs passed to powershell.exe, suspicious certutil decode operations, and scheduled tasks or Run keys that execute scripts from user-writable locations. Third, instrument telemetry to capture in-memory script execution and process command lines and correlate them with network egress to unfamiliar domains or cloud storage endpoints. Microsoft provides concrete hunting queries and detection guidance for PowerShell downloads and post-exploitation discovery behaviors that teams should adapt to their environments.

Hardening steps you can take right now include disabling legacy help formats where feasible, restricting execution policies and logging for PowerShell, enforcing macro protections, implementing application allowlisting for critical endpoints, and applying multi factor authentication coupled with conditional access to reduce credential theft impact. Combine these controls with proactive threat hunting for indicators like processes invoking wmic, powershell, certutil, or scheduled tasks that create persistence from user directories. Rapid7 and other vendor write ups include practical IOCs and persistence signatures that should be integrated into detection rules.

If you operate or defend South Korea-facing systems, assume reconnaissance is an ongoing operational phase used by DPRK-aligned operators to shape future intrusions. The defensive posture must therefore move beyond signature-based detection to behavior based telemetry, thorough logging of script execution and process lineage, and rapid containment workflows when anomalous discovery activity is detected. The adversary is methodical and adaptive. So must be your detection and incident response.