The report describes domestic attacks attributed to the Kimsuky threat group that use the GoldDragon and BravePrince malware clusters. According to the source, operators approach targets through spear phishing and deliver weaponized documents or malicious files that inject GoldDragon, collect system information, and communicate with command-and-control infrastructure. The follow-on BravePrince payload is described as a persistence and information-collection component that gathers host data and exfiltrates information through email-based mechanisms.