Genians reported a Kimsuky APT campaign that used Facebook personas posing as officials connected to North Korean human-rights work to approach South Korean security and North Korea-focused targets. After Messenger conversations, the operators shared malicious URL links through OneDrive and delivered MSC-based tooling assessed as similar to ReconShark, showing social-media reconnaissance and cloud-hosted delivery in the intrusion chain.