APT-C-55 (Kimsuky) used multilingual LNK lures to execute layered batch or PowerShell chains that established scheduled-task persistence, collected host and user data, and exfiltrated it through attacker infrastructure. The campaign abused renamed copies of certutil, curl, and NirCmd, used GitHub for payload hosting and configuration, and opened decoy documents to preserve the lure. A separate Windows-only supply-chain path embedded malicious test code in a cloned pybroker repository and activated when developers ran pytest.