360 Threat Intelligence Center profiles Kimsuky activity in the first half of 2021, describing a North Korea-linked espionage cluster focused on South Korean government, diplomatic, defense, academic, and think-tank targets. The campaigns relied heavily on spear-phishing with HWP or macro-enabled lure documents tied to meetings, questionnaires, and topical events, then used PowerShell, VBS, BAT scripts, desktop.ini persistence, and cloud or compromised-web infrastructure to collect host information. The report highlights repeated abuse of Google Blogspot, OneDrive, compromised Korean websites, and Hanmail/Daum accounts, including Gold Dragon-style samples that injected into svchost.exe and iexplorer.exe and exfiltrated encrypted data by email. Representative indicators include numerous MD5 hashes and defanged URLs such as connectter.atwebpages.com, quarez.atwebpages.com, worldinfocontact.club, and nuclearpolicy101.org paths.