Kimsuky is reported to have used Russian-looking sender addresses in credential-theft phishing after earlier waves relied mainly on Korean and Japanese email providers. The activity abused VK Mail.ru alias domains including mail.ru, internet.ru, bk.ru, inbox.ru, and list.ru to impersonate online portals and financial organizations such as Naver. Some MYBOX-themed lures claimed dangerous files had been found in the victim’s cloud account to create urgency and push users toward malicious links. Researchers also found messages that appeared to come from mmbox.ru and ncloud.ru were sent through a compromised Evangelia University email server using the Star PHP mailer, consistent with prior Kimsuky use of legitimate mailer tools. The campaign matters because stolen credentials could enable account takeover and follow-on social engineering against colleagues or contacts.