SECUi describes 2023 Kimsuky attacks in South Korea that used ZIP archives containing a decoy document and an LNK file disguised as a document to start reconnaissance malware. The LNK embeds obfuscated PowerShell, a lure document, and script modules; execution extracts BAT/VBS components, registers start.vbs under HKCU Run for persistence, and downloads RC4-encrypted payloads from attacker infrastructure. The BAT chain collects directory listings, public IP lookup data, task lists, and system information, then encrypts and uploads the results to C2. The report also notes tax, document-submission, and university-related Korean lures and C2 domains such as drives001.com, gdrive001.com, and cldservice.net.