360's report attributes an activity cluster to APT-C-55, also known as Kimsuky, and describes the use of GitHub as a payload delivery platform. The campaign involved lure files and code with similarities to prior Kimsuky malware, raw GitHub-hosted payloads, information collection, command download behavior, and indicators suitable for network and host hunting.