Qi An Xin reports suspected Kimsuky, tracked internally as APT-Q-2, targeting Korean organizations in sectors including defense, education, energy, government, healthcare, and think tanks. The observed malware set includes a Go dropper, DLL backdoors, and tooling delivered with BlueMoonSoft-signed decoy software, with C2 over dynamic DNS and functions for host and network reconnaissance, payload download, execution, keylogging, clipboard access, and screenshots. A newer backdoor variant checks hostnames against an embedded target list that includes DANAM, suggesting a possible focus on a Korean company tied to electronics, communications, and defense.