Kaspersky describes a Kimsuky GoldDragon cluster campaign against South Korean media and think-tank targets, using spear-phishing emails that led victims to macro-enabled Word documents or Hangeul decoys tied to Korean Peninsula geopolitical themes. The infection chain abused HTA and VBS components hosted on legitimate blog and commercial hosting services before delivering Windows malware capable of collecting file lists, keystrokes, and stored browser credentials. Server-side C2 scripts verified victim email, IP address, operating system, and user-agent values before serving payloads, reducing exposure during analysis. The report highlights Kimsuky’s multi-stage C2 tradecraft and rapid tool updates for DPRK-linked espionage operations.