Genians attributes a spearphishing and cyberespionage campaign targeting South Korean policy and security personnel to the North Korea-linked Kimsuky group with moderate confidence. Malicious LNK files launched a fileless PowerShell chain that used a public note page as a changeable command channel for XenoRAT, reconnaissance scripts, document exfiltration, and the newly named NodeLinkRAT. NodeLinkRAT ran JavaScript through an official Node.js runtime and supported command execution, file operations, archive exfiltration, and live screenshots over Socket.IO. Attribution was based on overlapping account assets, phishing infrastructure and kits, malware build fingerprints, service preferences, and target selection rather than any single indicator.