source_3989.pdf (5 MB)

Kimsuky continues to target South Korean military, government, and public-sector organizations with tailored spearphishing designed for long-term espionage access. Its delivery methods include malicious LNK files disguised as documents, counterfeit software-download pages, and fake meeting sites that execute a malicious camera-patch script before redirecting victims to a legitimate page. Persistence and remote access rely on scheduled tasks, Run keys, hidden administrator accounts, patched RDP components, Chrome Remote Desktop, AnyDesk, proxy tools, and a Gmail-stealing Chrome extension. The group also abuses GitHub, GitLab, and Codeberg repositories to host malicious scripts, stolen information, remote-access tools, and lure documents.