: Tails and Pines.7z , Tails and Pines.lnk , or related variations.
Spear-phishing emails containing a password-protected .7z archive to bypass automated email security scanners. Malware Type: Infostealer / Backdoor. Infection Chain
: Block the specific sender and update email filters to flag password-protected archives from unknown external sources. Tails and Pines.7z
: The malware collects system information, browser credentials, and specific document types, sending them to a Command and Control (C2) server. Key Indicators of Compromise (IoCs)
: Inside the archive is usually a malicious executable or a shortcut file ( .lnk ) disguised as a PDF or Word document. : Tails and Pines
: If the file was opened, assume all stored credentials (browser, VPN, email) are compromised and initiate a mandatory password reset.
: Look for unusual entries in HKCU\Software\Microsoft\Windows\CurrentVersion\Run designed to maintain persistence. Recommended Actions Infection Chain : Block the specific sender and
This archive typically serves as a delivery mechanism for malware designed to steal sensitive information from targeted individuals, particularly those involved in North Korean affairs, human rights, or diplomatic policy. Kimsuky (APT43).