APT-C-26 (Lazarus) added a dedicated keylogging component, KKernel.exe, to a previously observed custom remote desktop surveillance platform. It installs as KKernelService, escapes Session 0 by spawning an agent in the active user session, and restarts the agent if it terminates. The agent captures keystrokes through raw input, low-level hooks, and 10 ms asynchronous polling while recording the foreground window and process context under C:\ProgramData\Windows\WMI\Temp. Every 30 seconds, the malware sends new keystroke and debug logs to the previously configured C2 server and truncates the local files after successful transmission.