Cybereason Nocturnus documented Kimsuky’s KGH_SPY modular spyware suite and a related CSPY Downloader used in espionage operations against targets including South Korean institutions, human-rights groups, think tanks, research organizations, journalists, and other entities tied to Korean Peninsula issues. KGH_SPY provides reconnaissance, keylogging, information stealing, and backdoor capabilities, while CSPY Downloader adds anti-analysis checks before retrieving additional payloads. The investigation linked new infrastructure to prior Kimsuky tooling such as BabyShark and AppleSeed through URI patterns, domains, strings, file naming, revoked EGIS code signing, PDB paths, and shared decryption behavior. The report also notes weaponized Word-document infection vectors and timestamp tampering intended to complicate forensic analysis.