Kimsuky is a highly motivated APT that has traditionally targeted entities in South Korea. The APT group has used a variety of malware such as Gold Dragon, Babyshark and Appleseed to target entities ranging from defense to education and think tanks. Some file enumerators will exfiltrate all files with specific extensions. What's interesting here, however, is that the attackers knew exactly which files they were looking for