A Korean malware-analysis post attributes DDD.html to Kimsuky and describes it as JavaScript/VBScript malware used in North Korea-linked activity against South Korea-focused targets. The sample hides VBScript logic that creates a WScript.Shell object, attempts to kill mstsc.exe and shut down the system, and sends synchronous POST traffic to zetaros.000webhostapp.com search paths. The source lists multiple hashes for the HTML sample, C2-style URLs under zetaros.000webhostapp.com, IPs 145.14.144.162 and 145.14.145.67 on TCP/80, and antivirus detections such as Downloader/VBS.Kimsuky.S1997 and VBS/TrojanDownloader.Agent.YND. The report is useful for Kimsuky tracking because it ties script behavior, network infrastructure, and representative file indicators to a specific March 2023 sample.