Kimsuky activity is described using a password-protected ZIP containing a PDF-themed LNK named Update Schedule_INVITATION - 250625 UNC Ambassador's Roundtable.pdf.lnk. The lure impersonated a United Nations Command ambassador roundtable invitation and was reportedly sent from a Gmail account to a southern European foreign ministry target. Execution decodes embedded Base64 PowerShell, downloads a decoy PDF and additional scripts from raw.githubusercontent.com/landjhon/tokula, and writes components such as chrome.ps1, temp.ps1, and system_first.ps1 under temporary and AppData paths. Persistence is established with a hidden scheduled task that starts after five minutes and repeats every 30 minutes, running PowerShell with hidden, no-profile, non-interactive, and execution-policy-bypass flags.