Security researchers uncovered a sophisticated multi-stage attack campaign by Kimsuky, a North Korean state-sponsored threat group, targeting government agencies and think tanks. The attack leveraged Visual Studio Code extensions, GitHub, and compromised subdomains (e.g., *iuh234.medianewsonline[.]com*) as command-and-control (C2) infrastructure to deploy ransomware and reconnaissance malware. The infection chain began with a JavaScript file (*Themes.js*), which downloaded secondary payloads to harvest system details, running processes, and files from the *Users* directory. Collected data was exfiltrated via encoded cabinet files using certutil (a Living-Off-The-Land Binary) to evade detection. Persistence was established via a scheduled task (*Windows Theme Manager*), ensuring long-term access even after reboots. The campaign demonstrated espionage-focused tactics, with attackers conducting extensive system reconnaissance before potential ransomware deployment. The use of legitimate platforms (GitHub, VS Code extensions) for C2 and social engineering lures (e.g., *E-CARD.docx*) highlights the group’s ability to bypass traditional defenses. The attack poses severe risks to national security, sensitive government data, and critical infrastructure, with implications for geopolitical stability if high-value intelligence is compromised.