Trellix attributes an active early-2025 espionage campaign against embassies and foreign ministries in Seoul to DPRK-linked actors, with infrastructure overlaps to known Kimsuky operations. The attackers sent at least 19 spear-phishing emails impersonating diplomats and officials, using password-protected ZIP files that contained disguised PDF/LNK shortcuts. Execution launched obfuscated PowerShell, performed host reconnaissance, abused GitHub APIs for exfiltration and C2 coordination, and retrieved payloads from cloud storage such as Dropbox and Daum. The final payload was a Confuser-obfuscated XenoRAT variant associated with MoonPeak patterns, giving operators remote access, keylogging, screenshots, file transfer, and shell capability. The campaign matters because it shows diplomatic espionage blending trusted cloud and developer platforms with rapidly rotated payload infrastructure to evade network defenses.