360’s retrospective report attributes a spear-phishing and server-compromise activity cluster to Kimsuky, also tracked as BabyShark, Thallium and Black Banshee. The activity used malicious macro documents, DLL hijacking files such as version.dll and wtsapi32.dll, malicious Normal.dotm templates, OneDrive-hosted VBS payloads, compromised websites and hardcoded commands to stage follow-on scripts and report victim status. The researchers also found compromised servers with detect.vbs backdoors, RDP scanning tools, AnyDesk-based remote-control tests, keylogging scripts and security-tool archives, showing the group’s use of third-party cloud storage and already-breached servers as operational infrastructure.