Picus profiles Kimsuky as a North Korean espionage actor active since at least 2012 and tracked under aliases including Black Banshee, Velvet Chollima, THALLIUM and Emerald Sleet. The source describes targeting of South Korean government, think-tank, defense and policy interests, with later activity extending to the United States, Japan, Russia and Europe. It highlights the DEEP#GOSU campaign, where phishing attachments executed PowerShell and VBScript to pull payloads from services such as Dropbox and deploy remote access malware including TruRat. The article also summarizes Kimsuky use of spear phishing, RandomQuery, xRAT and Gold Dragon for keylogging, remote shell access, persistence and data exfiltration.