BlueEstimate is a Kimsuky campaign observed from late 2019 through at least 2023 against South Korean targets in science and technology, defense, and North Korea-related fields. Its social-engineering lures impersonated official or sensitive documents, including event estimates, technical drawings, identity records, and an online mail-security program, often using double extensions to disguise executables. Campaign payloads collected host identifiers, used DLL hijacking or injection through legitimate software, established persistence, and provided command-and-control functions such as file transfer, process discovery, and self-deletion.