Rapid7 attributes a recent wave of activity with moderate confidence to Kimsuky, also known as Black Banshee or Thallium, and frames it as an updated espionage playbook. The activity uses CHM help files delivered in containers such as ISO, VHD, ZIP, or RAR to bypass initial defenses and execute hidden JavaScript, ActiveX, and Base64-encoded VBScript on Windows systems. The CHM lure content is Korean and themed around North Korean nuclear issues, while the embedded commands decode a VBS file, establish Run-key persistence, collect system, process, recent document, and directory information, and exfiltrate it to attacker infrastructure. Observed C2 paths include 00701111.000webhostapp.com/wp-extra and gosiweb.gosiclass[.]com/m/gnu/convert/html/com/list.php?query=6, with related samples showing code reuse and continued refinement into 2024.