AhnLab describes continued Kimsuky use of AppleSeed, a backdoor that can execute operator commands, download additional malware, log keystrokes, capture screens, and collect files from infected systems. Recent cases changed the installation flow by adding a dropper and argument checks before regsvr32 installs the AppleSeed DLL, making standalone sandbox execution less reliable. The report also covers AlphaSeed, a Go based AppleSeed variant that uses ChromeDP and email account cookies for C2 communications, plus Kimsuky’s continued use of Meterpreter and custom VNC tools such as TightVNC and TinyNuke HVNC. The activity shows Kimsuky keeping older AppleSeed tradecraft while shifting remote control and installation details.