A Kimsuky-attributed LNK impersonates the United States Studies Centre and a Track 1.5 Australia-Korea-Japan dialogue on future-oriented cooperation. The shortcut locates PowerShell, finds a same-size LNK, extracts and opens an embedded PDF decoy, then XOR-decodes a VBS payload into the Public Videos directory. It creates a scheduled task named authentication_up to run the VBS every 18 minutes, using a Chrome icon to make the lure appear less suspicious. The VBS downloads a file from 103.149.98.247 under /vs/tt/d.php, renames it as a batch file, executes it silently, and deletes it, indicating a staged downloader chain aimed at policy, diplomacy, or regional-security targets.