Smoke Screen is a long-running Kimsuky campaign targeting South Korean and U.S. foreign-policy, defense, security, unification, and North Korea-focused communities. Operators impersonate trusted institutions or experts in spear-phishing emails, using counterfeit login and large-file-download pages, malicious Office documents, and topical lures such as COVID-19 guidance to steal credentials or execute malware. Reporting also links the activity to covert freelance-development and cryptocurrency dealings, assessing it as North Korean-backed while noting the operators’ efforts to conceal their identities and nationality.