UN Panel of Experts S/2023/656
Malware hidden with Alternate Data Stream
Para 109: “In a separate case, Kimsuky has been reported using Alternate Data Stream to hide a malware that collects data by starting the Visual Basic Script included inside a HyperText Markup Language (HTML) file.”