Kimsuky activity described in the source uses a PowerShell malware sample tracked as 1.ps1 to collect host, user, process, disk, and IP information into temporary files and stage the data for exfiltration. The report publishes hashes for the sample and shows a constructed command-and-control upload path impersonating Kakao account-related content, supporting detection of PowerShell-based reconnaissance and data theft tradecraft.