AhnLab details Kimsuky activity in which presumed spear phishing led to BabyShark installation and later deployment of RDP-control tooling on compromised Windows systems. The group used scripts and loaders such as hwp.bat, k.ps1, OneNote.vbs, pow.ps1, and desktop.r7u to collect information, log keystrokes, decrypt payloads, and inject code into legitimate processes. Additional payloads included multiple.exe, which changes termsrv.dll, enables multiple RDP sessions, and creates a hidden IIS_USER administrator account. A RevClient component receives C2 commands, can manage user accounts, and forwards attacker traffic to local RDP, with 5.61.59.53:2086 shown as the main C2 endpoint.