AhnLab attributes Larva-24005 to activity associated with Kimsuky, describing intrusions against software, energy, and financial targets in South Korea and broader infrastructure spanning multiple countries. The report cites RDP exposure and BlueKeep CVE-2019-0708 as part of the intrusion context, followed by MySpy deployment, RDPWrap installation, RDP configuration changes, and keyloggers such as KimaLogger or RandomQuery. It also notes phishing mail activity from compromised systems and infrastructure using r-e.kr and kro.kr domains.