S2W Talon assesses that Kimsuky or a closely related cluster distributed Troll Stealer through installers masquerading as SGA Solutions security software on a Korean download page. The dropper and decoy installer were signed with a valid D2innovation Co.,LTD certificate, dropped a VMProtect-packed Go DLL, and ran it through rundll32 while showing the victim a normal TrustPKI or NX_PRNMAN installer. Troll Stealer gathers SSH, FileZilla, Microsoft Sticky Notes, GPKI, browser, screenshot, and system data, encrypts the files, and sends them to C2 endpoints such as qi.limsjo.p-e.kr and ai.limsjo.p-e.kr. S2W links the malware to Kimsuky tradecraft through similarities with AppleSeed and AlphaSeed, while noting that some TTP differences leave room for a closely aligned operator.