North Korean threat actors Kimsuky and ScarCruft are actively targeting South Korean organizations through phishing campaigns that use legitimate cloud services, GitHub and Dropbox, as command-and-control channels, making malicious traffic difficult to distinguish from normal business activity. The campaigns rely on social engineering via Hangul Word Processor documents and Windows shortcut files rather than software vulnerabilities, meaning no patch exists to block initial access. Organizations with South Korean operations, government ties, or defense-adjacent work face elevated risk; existing signature-based and reputation-based security controls are likely insufficient against this approach.