This article details a Kimsuky APT campaign employing a multi-stage kill chain initiated by a CHM file dropper, which executes a VBScript stager to ultimately deploy a PowerShell-based keylogger. The analysis was conducted by recovering a live command and control (C2) server, providing full visibility into the attack sequence. No CVSS score, specific affected software versions, fixed versions, or workarounds are provided in the source material.