ASEC reports that Kimsuky activity used files masquerading as normal documents by appending document-related extensions such as DOCX, PDF, and TXT to executable malware. The malware dropped and opened decoy files, stole information from infected PCs, and attempted to download additional suspected backdoor DLL payloads from infrastructure resembling previously observed Kimsuky command-and-control patterns. The targeting context included South Korean government agencies and university professors.