Kim Sooki again? This time, it was disguised as a request for seafood ingredients

AhnLab describes a Kimsuky-linked attack where a malicious LNK file disguised as a seafood ingredient purchase request displays a decoy HWP while extracting an XOR-encrypted ZIP containing a PowerShell script (termsvc.Ps1) and JavaScript payloads. The attacker registers a scheduled task (MicrosoftOffice2016_*<UUID>) to run obfuscated JS every ~14 minutes, collects OS/user/process/public IP/BIOS serial information, exfiltrates data to Backblaze B2 as a C2 channel, downloads and executes follow-up commands from the same cloud storage, and attempts to remove initial artifacts; the report provides file paths, task patterns, and a checklist for detection and response.