DEEP#DRIVE is an ongoing Kimsuky campaign targeting South Korean businesses, government organizations, and cryptocurrency users. The operators used tailored Korean-language phishing lures disguised as work logs, insurance records, and cryptocurrency documents in trusted formats, while Dropbox hosted payloads and received stolen system information. The multistage chain relied heavily on obfuscated PowerShell for delivery, reconnaissance, and execution, established persistence through scheduled tasks, and used short-lived infrastructure and trusted cloud services to blend malicious activity into normal user behavior.