The post analyzes an APT37, also known as Reaper, malware package distributed as a ZIP archive with a Korean security commentary lure. The infection chain runs from ZIP to LNK to BAT to shellcode, with PowerShell hidden from the user, embedded HWP lure content extracted from the LNK, and additional payload data written under public and temporary paths before execution. The lure impersonates a national security researcher and abuses a topical article about anti state forces to make the file credible to Korean targets. Reported network indicators include pCloud API endpoints and several defanged IP addresses and URLs used for command and control or payload retrieval.