AhnLab observed malicious Word documents using North Korea-related diplomatic and security themes, including filenames about North Korean foreign policy and military parade analysis. The documents contained obfuscated VBA macros that created a version.ini file under the Microsoft Templates directory and executed it with wscript.exe. The macro attempted to retrieve and run code from URLs such as g00gledrive.mywebcommunity[.]org and impartment.myartsonline[.]com using list.php?query=1. AhnLab detected the activity as Downloader/DOC.Kimsuky and linked it to a recurring actor pattern using document protection removal, the password 1qaz2wsx, and similar macro execution logic.