ESTsecurity attributes a new malicious LNK operation targeting South Korean organizations to Kimsuky based on the group's established shortcut-based delivery and Korean business-document lures. The chain uses batch scripts, renamed Windows utilities, and scheduled tasks to perform reconnaissance and maintain five-minute execution intervals. GitHub distributes common and MachineGuid-specific commands, a Wasmer-hosted WordPress endpoint records infection beacons, and Dropbox receives stolen data. Selected hosts can be redirected to separate repositories that reduce reconnaissance activity or deploy reverse-tunnel access through Pinggy.