Kimsuky-linked spear phishing targeted a South Korean company's information-security staff by impersonating a customer asking about a suspected personal-data leak. The attacker built trust through multiple emails, then delivered malicious LNK files disguised as customer-status documents and resent the payload in a password-protected ZIP after an initial link was blocked. ESRC analyzed three samples that shared an LNK-based initial chain but split into two C2 frameworks: Dropbox API-based command exchange with RC4-decrypted PowerShell and scheduled-task persistence, and direct HTTPS C2 using a startup VBS plus a batch decoder loop. The campaign used Korean decoys, anti-analysis and self-deletion features in one sample, and infrastructure at toopel.shop for the Type B path.