North Korea-Linked Group Levels Multistage Cyberattack on South Korea

North Korea-linked APT Kimsuky (DEEP#GOSU) ran an eight-stage campaign against South Korean targets using LNK email attachments that pull PowerShell/VBScript from Dropbox/Google, install .NET components and the TutClient RAT, and ultimately deploy persistence and keylogging; the operators rely on living-off-the-land techniques, AES-encrypted stages, and legitimate cloud services to blend traffic and evade detection while pursuing cyber espionage and cryptocurrency-focused financial crime.