Genians analyzed a March-April 2025 AppleSeed campaign attributed in the report to Kimsuky, a North Korea-linked state-sponsored group active against defense, military, cryptocurrency, vaccine, and North Korea-related activist targets. The operators used a multi-channel approach across Facebook, email, and Telegram, including hijacked or deceptive Facebook accounts, Korean-language social engineering, and lures about volunteer support for North Korean defectors. Malicious payloads were delivered in password-protected EGG archives and included obfuscated JSE scripts that created a decoy PDF while decoding and launching malicious DLL components through PowerShell, certutil, and regsvr32. The report links the activity to historical AppleSeed artifacts through PDB paths and describes evasion choices such as Korea-specific archive formats, Base64-encoded scripts, and Windows-focused execution flows. It matters because the campaign shows Kimsuky combining trusted social relationships, multiple messaging platforms, and tailored lures to reach sensitive Korean targets.