Ghost: Clients.zip

: Recording every keystroke to capture login credentials and private communications.

: Extracting saved passwords and cookies from Chrome, Edge, and Whale (a popular Korean browser). 4. Attribution: The Kimsuky Connection

: The LNK file executed a PowerShell command that reached out to a Command and Control (C2) server. Ghost Clients.zip

Security researchers attributed this campaign to based on several "fingerprints" found in the code:

: The initial script collected basic system information (OS version, running processes, and network configuration) to verify if the victim was a high-value target or a security researcher's "sandbox." : Recording every keystroke to capture login credentials

: The emails often masqueraded as legitimate communications from South Korean government agencies or think tanks.

The operation is named after the specific archive file, Ghost Clients.zip , which served as a central delivery vehicle for a sophisticated multi-stage malware infection chain. 1. Delivery and Initial Access Attribution: The Kimsuky Connection : The LNK file

It serves as a reminder of the persistent threat posed to the Korean Peninsula's digital infrastructure and the continued refinement of social engineering techniques used by APT (Advanced Persistent Threat) groups.