The Chinese-language analysis attributes activity to Kimsuky and describes exploitation of ConnectWise ScreenConnect CVE-2024-1708 and CVE-2024-1709 to deploy ToddlerShark, a newer variant related to BabyShark and ReconShark. After gaining access to ScreenConnect endpoints, the operators use Microsoft binaries such as mshta.exe to run obfuscated VBScript, modify Office macro settings, and create scheduled tasks for persistence. ToddlerShark collects host information, encodes it in PEM certificate data, and exfiltrates it to C2 infrastructure. The report also reviews BabyShark behavior, HTA-based staging, macro persistence, HTTP C2 traffic, registry changes, and representative hashes and URLs for hunting.