A state-sponsored threat group tracked as "Kimsuky" sent QR-code-filled phishing emails to US and foreign organizations.