ESRC reports a North Korea-linked spear-phishing case impersonating the president of Pyongyang University of Science and Technology and exploiting CVE-2021-40444 in a malicious DOCX document. If opened on an unpatched Microsoft Office system, the document contacts officeversion.mywebcommunity[.]org, executes attacker-controlled script, then connects to msoffices.atwebpages[.]com and a Google Blogspot command source to collect and exfiltrate host information. ESRC links the activity to the same POSEIDON author account seen in earlier attacks against defense, security, diplomacy, and unification experts. The report underscores continued DPRK adoption of document vulnerabilities such as CVE-2020-9715 and CVE-2021-40444 for tailored targeting.