Sangfor links this Kimsuky activity to malicious LNK files disguised as Korean PDF or HWP documents for targets in cryptocurrency, government, diplomacy, media, and North Korea policy circles. One lure posed as a Korean cryptocurrency trading lecture and used PowerShell to pull ps.bin from Dropbox, which then loaded r_enc.bin and a TutClient remote-control component. The chain wrote a VBS stage under the Windows Templates directory, fetched a decoy PDF from hyojadong.kr, created scheduled tasks, and downloaded later PowerShell payloads. The operation used Dropbox for both staging and exfiltration, including scripts that collected host and file information and uploaded the results through Dropbox APIs.