Genians attributes a multistage cyberespionage campaign targeting South Korean policy and security professionals to Kimsuky with moderate confidence. A reply-based spearphishing lure delivered a disguised LNK that established scheduled-task persistence and repeatedly executed attacker-controlled code retrieved from a public note page. The actor rotated among XenoRAT, reconnaissance and document-theft scripts, Dropbox and MEGA exfiltration, and NodeLinkRAT, a JavaScript RAT executed through an officially signed Node.js runtime. Attribution rests on overlaps in account assets, phishing infrastructure, custom XenoRAT build fingerprints, target selection, and previously documented Kimsuky activity.