Kimsuky distributed Funhouse ransomware through a malicious HWP resume that launched a multi-stage chain of batch, VBS, PowerShell, Python, and bitmap-embedded payloads. Quasar RAT served as the final loader for the ransomware, and its configuration, mutex, and supporting scripts connected the activity to Kimsuky's earlier 2026 Endpoint ransomware campaigns. Funhouse preserved core Endpoint family characteristics while changing the encrypted-file extension, contact addresses, cryptographic implementation, and infrastructure. The campaign also marked a delivery shift from malicious LNK files to a user-activated hyperlink inside a Hangul document.