Kimsuky abused the Microsoft Office Equation Editor vulnerability CVE-2017-11882 to deliver keylogger malware against Korean targets. The report describes mshta execution of a malicious error.php page, PowerShell retrieval of follow-on payloads from command-and-control infrastructure, persistence via a Run key named Clear Web History, and staging under the Users\Public\Pictures path.