ASEC identified malware associated with Larva-25004, a group connected to previously reported Kimsuky activity, that was signed with a Nexaweb Inc. certificate. The two discovered SCR files were signed on May 24 and May 28, 2024, using certificate serial 0315e137a6e2d658f07af454c63a0af2. When executed, the malware shows a job-related PDF lure, and the bait suggests possible targeting of people interested in defense-industry employment. ASEC found no malware among files signed with Nexaweb's earlier certificate and noted that the suspicious certificate appeared only on the two malware files under review.