Kimsuky Threat Research Report-2

This report from Aryaka Threat Research Lab documents a multi-stage Kimsuky APT cyber-espionage campaign targeting South Korean entities, detailing an infection chain that begins with malicious LNK/HTA files and uses obfuscated VBScript/PowerShell, persistence, anti-VM checks, reflective DLL injection and in-memory loaders to steal browser credentials, keylog keystrokes and sensitive files, exfiltrating data in 1MB HTTP chunks to C2 servers; it provides IoCs, MITRE ATT&CK mappings, victimology, and mitigation guidance.