QiAnXin attributes a January 2024 intrusion set to Kimsuky/APT-Q-2 based on overlap with earlier Kimsuky malware and shared signing, packing, language, and victim-ID patterns. The activity used installers disguised as SGA Solutions products to drop normal setup files while running VMProtect-packed Go malware, including a one-shot stealer identified as TrollAgent and a related backdoor. TrollAgent collects configuration data, SSH and FileZilla directories, Microsoft Sticky Notes, browser data, screenshots, installed-program and system information, then encrypts and exfiltrates the results to C2 URLs such as ar.kostin.p-e.kr and ai.kostin.p-e.kr before deleting itself. The related backdoor persists as svchost.exe via a WindowsUpdate scheduled task and communicates with a compromised Korean domain over randomized POST parameters.