ASEC described weekly changes in CHM malware distributed with lures impersonating South Korean financial companies and insurers. Earlier variants launched hh.exe, decompiled embedded HTML, created a .jse script, and used wscript plus PowerShell to download and execute additional code while maintaining Run-key persistence. A later variant changed behavior depending on whether AhnLab software was installed, while a second variant directly dropped and executed a .NET backdoor intended for reverse-connection access rather than only information theft. The report provides EDR detection names, malware classifications, hashes, and atusay.lat/zienk.sbs URLs for defenders tracking the evolving CHM execution chains.