A Seoul ADEX 2025-themed LNK is assessed as suspected APT37 activity and likely RoKRAT. The shortcut poses as a PDF for an international UAV and defense exhibition, runs PowerShell through Pester.bat, shows a decoy document, and retrieves staged components from unmannedsystemstechnology.org. The script renames payloads to resemble VLC files, creates a scheduled task named NewErrorReport for minute-based persistence, and deletes traces after execution. The lure points to possible targeting of airshow or defense-related users in South Korea, although the source does not confirm specific victims.