In September 2026, Kimsuky distributed Funhouse ransomware through a resume-themed Hangul document containing embedded OLE data. A user-activated hyperlink launched a multi-stage chain of batch, VBS, PowerShell, Python, and bitmap-embedded payloads that installed Quasar RAT before executing Funhouse as RuntimeBroker.exe. ASEC assessed Funhouse as a continuation of Kimsuky's Endpoint ransomware activity, retaining the family's ransom-note, mutex, and encryption design while changing its encrypted-file extension, contact addresses, cryptography, and infrastructure.