On 04 May 2023, SentinelOne reported that they identified an ongoing campaign from Kimsuky, a North Korean state-sponsored APT group, that modified its reconnaissance component, called RECONSHARK by SentinelOne, of the BABYSHARK malware. Kimusky weaponized BABYSHARK with the updated reconnaissance component in a macro-enabled Word document hosted on OneDrive, delivering spear-phishing emails with the OneDrive link. RECONSHARK can deploy further payloads and sends the information collected to the command and control server via HTTP POST requests as string variables. A previous Palo Alto's Unit 42 analysis of BABYSHARK reported that the first stage used mshta.exe to load and execute an HTA file from the C2 server. BABYSHARK then registers two scripts as scheduled tasks and a registry key to maintain persistence. The scheduled task launches cmd.exe, and the registry key value runs mshta.exe to execute an HTA file hosted on a C2 server.