Executive Summary
The North Korean threat actor Kimsuky (APT-C-55) has initiated a complex multi-path campaign primarily targeting South Korea, with suspected global reach into Japan, Vietnam, and Germany. The campaign targets insurance, finance, and research sectors using decoy documents themed around contracts and policy agreements.
Technically, the group employs three distinct delivery vectors: phishing emails delivering LNK files that execute Base64 scripts, PowerShell-based loaders disguised as PDFs, and a supply-chain attack involving a poisoned version of the open-source 'pybroker' library. These paths converge on a common goal: persistent information theft via scheduled tasks and the abuse of legitimate system binaries (LOLBins) to collect system metadata, account lists, and sensitive documents. The use of GitHub as a hosting platform for secondary payloads and specialized C2 infrastructure demonstrates a high level of operational maturity and persistence.