360 attributes with medium confidence an APT-C-55/Kimsuky campaign that used Korean-language artifacts and a birthday-greeting CHM lure to target South Korea. Execution of the CHM loaded remote VBS and PowerShell stages, created a WindowsAppCertification directory under ProgramData, established a scheduled task, and downloaded additional payloads from Google Drive URLs. The loader, identified internally as ProcessHollowingCsharp, RC4-decrypted Quasar RAT v1.3.0.0 and injected it into CasPol.exe, matching previously reported Kimsuky QuasarRAT activity and related malicious document tradecraft.