Keylogger Installed Using MS Office Equation Editor Vulnerability (Kimsuky)

**Executive summary:** AhnLab ASEC details a Kimsuky campaign exploiting CVE-2017-11882 in MS Office EQNEDT32.EXE to launch a malicious mshta-hosted script (error.php) that uses PowerShell to download a downloader and a keylogger, establish persistence (desktop.ini.bak in public folders and Run key registration), collect system/IP and keystroke/clipboard data, and communicate with C2 servers; the report includes file detections, MD5 hashes, and mitigation recommendations.