AhnLab analyzes Kimsuky's continued use of AppleSeed in spear-phishing operations against South Korean and other targets in defense, media, diplomacy, government, and academia. Recent intrusions still distribute AppleSeed through JavaScript droppers, malicious documents, or Excel macros, but newer AppleSeed DLLs add Regsvr32 execution-argument checks that prevent standalone sandbox execution and delete themselves when the argument is wrong. The report also tracks AlphaSeed, a Golang AppleSeed-like variant that communicates through ChromeDP and email protocols, sometimes deployed alongside AppleSeed after certutil-based installation. Post-compromise tooling includes Meterpreter, customized TightVNC, TinyNuke/HVNC variants, RDP abuse, and Chrome Remote Desktop, showing Kimsuky's emphasis on persistent remote control and information theft.