AhnLab reported Kimsuky document malware distributed beyond security-related targets to broadcasting and ordinary corporate users. The lures used DOCX filenames such as questionnaires, cover letters, and planning documents, then relied on template injection to download malicious Word macro templates from compromised Korean websites. When macros ran, a batch file used curl to fetch a decoy document and VBS payload, which collected system, antivirus, recent Word-file, download-directory, process, and IE registry information before registering persistence through Task Scheduler. Representative infrastructure included gdtech[.]kr, ddim.co[.]kr, and hydrotec.co[.]kr paths serving init.dotm, state.dotm, list.php, and show.php components.