ESRC reported continued activity by the North Korea-linked Thallium/Kimsuky group under its Blue Estimate APT campaign, with new malicious files produced in November 2020. The activity targeted South Korean science, technology, and defense-related sectors and used reconnaissance or intrusion emails tied to C2 hosts such as kaist.r-naver[.]com, kaist.krfa[.]ml, kaist-ac[.]xyz, vpn.karist[.]cf, and app.veryton[.]ml. A newly found 64-bit DLL exported as ut_zeus(x64).dll connected to app.veryton[.]ml, while an earlier 32-bit variant used eastsea.or[.]kr. ESRC linked the infrastructure to prior Thallium operations through shared IP ranges, Porkbun registrations, recurring domains, and registrant email patterns.