A recent disclosure by the National Security Agency (NSA), Federal Bureau of Investigation (FBI), and several other agencies issued a cyber threat warning about a new social engineering campaign being conducted by North Korean threat actors. The North Korean state-sponsored threat group is tracked as Kimsuky, otherwise known as APT43/Black Banshee, and has been conducting numerous social engineering campaigns over the past several years. Often targeting education, academics, media outlets, and research institutions throughout the United States, Japan, and South Korea, these threat actors commonly compromise companies for the sole purpose of intelligence gathering. In this recent campaign, Kimsuky threat actors utilized varying social engineering lures to gain trust with the victim. Threat actors would then pass a link to a spoofed domain with a login portal which would lead to the download of a malicious executable. This sequence of events would lead to the compromise of a user’s personal identifiable information (PII) in addition to their device. The downloaded macro-enabled document contains macro-malware which first establishes a connection to actor-controlled command-and-control (C2) servers, followed by remotely executed commands downloading payload droppers onto the users’ device. At that point, threat actors have the capability to gather information from their victim device and utilize it for the threat group’s mission. CTIX continues to urge users to validate the integrity of all email communications prior to visiting any embedded links or downloading any attached files.