Qihoo 360 attributes a multi-stage infection chain to Kimsuky (APT-C-55), beginning with a trojanized OrionQuests installer that drops a malicious LNK file. The LNK decrypts PowerShell that checks for analysis tools and virtual machines, profiles the host, and retrieves a disguised second-stage .NET payload. Persistence relies on a scheduled task masquerading as a Google Chrome update. The modular backdoor connects to 107.172.249.140 over TCP port 443 and supports encrypted delivery of additional plugins.