The DPRK-relevant section analyzes a Kimsuky malicious LNK sample used for initial access and payload staging. The shortcut points to mshta.exe, a legitimate Windows utility, and uses obfuscated JavaScript to run PowerShell with execution policy bypass. The PowerShell searches for a specific LNK file by size, extracts hidden data from it after a fixed offset, writes a new script to ProgramData, and launches the staged content. The author reports that the extracted d.ps1 script is obfuscated and downloads a ZIP archive named gs.zip containing the final payload. The blog also compares other APT initial-access examples, but the Kimsuky evidence is specifically centered on LNK abuse, LOLBin execution, PowerShell staging, and simple YARA detection strings.