While the Kimsuky group often used document files for malware distribution, there have been many recent cases where CHM files were used in distribution. Recently, there has been an increase in malware distribution targeting particular users using personal information. It seems that the threat actor checks the stolen user information, and only when the system is a target of attack, uploads additional malicious files to the C2. AhnLab Security Emergency response Center (ASEC) has continuously been tracking the Kimsuky group’s APT attacks.