Kimsuky used spear phishing attachments and download links to deliver archive files containing decoy documents and malicious LNK shortcuts, then unpacked BAT and VBS scripts for collection, persistence, and payload download. ASEC analyzed 2023 activity where the group installed XRat, Amadey, and RftRAT after initial access, including loaders that decrypted payloads from companion configuration files and injected them into normal processes. The report notes newer AutoIt variants of Amadey and RftRAT, with Amadey preserving its HTTP request structure, Korean antivirus checks, DGA-based backup C2 logic, and support for additional exe, DLL, PowerShell, VBS, and JavaScript payloads. RftRAT activity included svchost.exe injection, UAC bypass through ICMLuaUtil, system information collection, and command handling through files under the user profile.