Kimsuky used a Korean-language CHM lure about North Korean food-crisis and right-to-food material to launch hidden PowerShell, decode a VBScript bootstrap, and retrieve staged payloads from DynV6-hosted infrastructure. The retrieved VBScript profiled the host with WMI, enumerated selected folders and running processes, uploaded a Base64 inventory as Info.txt, and installed a hidden hourly scheduled task named Edge Updater. A later loader requested a second VBScript stage that handed execution to PowerShell and contacted a final checkservice.php endpoint expected to define LogAction, but controlled replay returned an empty body, indicating selective final payload delivery. The report provides C2 domains, IPs, hashes, host artifacts, and behavioral detections for CHM-to-VBScript-to-PowerShell activity.