The North Korean hacking group Kimsuky has been observed using a custom-built RDP Wrapper and proxy tools in recent attacks, marking a shift in their tactics. This evolution sees Kimsuky adopting a diverse set of customized remote access tools rather than solely relying on traditional backdoors like PebbleDash. Kimsuky’s latest attack strategy involves spear-phishing emails containing malicious shortcut (.LNK) file attachments, disguised as PDFs or Word documents. These emails are personalized, featuring the recipient’s name and correct company names, indicating prior reconnaissance. Upon opening the .LNK file, PowerShell or Mshta is triggered to download additional payloads from an external server. The payloads include PebbleDash for initial system control, a modified version of the RDP Wrapper tool for persistent RDP access and security measures bypass, and proxy tools to navigate around private network restrictions. The RDP Wrapper, originally an open-source tool for enabling RDP on Windows versions that do not support it natively, has been altered by Kimsuky to evade antivirus detection and signature-based defenses. This tool allows the group to maintain a low profile by treating RDP connections as legitimate, providing a more user-friendly remote-control interface and bypassing firewalls or NAT restrictions through relays. Once Kimsuky establishes a foothold on a network, they deploy secondary payloads, including a keylogger that captures keystrokes, an infostealer (forceCopy) for extracting web browser credentials, and a PowerShell-based ReflectiveLoader for in-memory payload execution. These tools underscore Kimsuky’s persistence and evolution as a significant cyber-espionage threat group from North Korea, dedicated to intelligence gathering. These findings highlight Kimsuky’s shift towards stealthier remote access methods, enabling prolonged dwell times within compromised networks. This adaptation reflects the group’s ongoing efforts to enhance their espionage capabilities while evading detection for extended periods.