Securonix tracks DEEP#GOSU as a multi-stage campaign likely associated with Kimsuky and aimed at South Korean victims. The infection chain begins with a ZIP-delivered PDF-themed LNK file that extracts and opens an embedded Korean PDF lure while running PowerShell to authenticate to Dropbox, decrypt, and execute next-stage payloads. Later stages use PowerShell and VBScript stagers, dynamically load .NET code in memory, and pull payloads such as r_enc.bin from Dropbox, supporting RAT functionality and ongoing monitoring. The campaign uses legitimate cloud services including Dropbox and Google Docs for C2 and payload delivery, helping the traffic blend into normal network activity while enabling the operators to update modules remotely.