Kimsuky is targeting foreign-affairs personnel with spearphishing lures that execute malicious LNK files and install PebbleDash, PrxClient, RDP tooling, UAC bypass utilities, and a keylogger. PebbleDash provides extensive remote command, file-transfer, process-control, and system-reconnaissance capabilities, while PrxClient forwards C2 traffic to the victim's local RDP port. The attackers also create backdoor accounts, patch Windows RDP components for multiple sessions, and use scripts to collect and exfiltrate local files. AhnLab observed two delivery chains involving PowerShell or embedded HTA scripts, downloaders, scheduled-task persistence, and diplomatic-themed decoy documents.