ESTsecurity linked a malicious LNK campaign targeting Korean organizations to Kimsuky based on its delivery method, document lures, and established targeting patterns. The infection chain uses batch scripts, renamed Windows utilities, NirCmd, and a five-minute scheduled task while GitHub distributes common and MachineGuid-specific commands. Infection notifications are sent through a Wasmer-hosted WordPress endpoint, collected system information is uploaded through the Dropbox API, and selected hosts can be moved to quieter repositories for subsequent remote access. Separating these functions across trusted services makes the campaign harder to reconstruct and disrupt through any single network control.