AhnLab describes a targeted malicious Word-document campaign that continued using the same external-template macro pattern seen in earlier Korean political and policy-advisory lures. Recent DOCX files used biography, inter-Korean summit, and U.S.-Korea dialogue themes and fetched malicious DOTM templates from defanged domains including tbear.mypressonline.com, modri.myartsonline.com, visul.myartsonline.com, ccav.myartsonline.com, and jupit.getenjoyment.net. When opened, the macro launched PowerShell, reconstructed obfuscated commands, downloaded scripts such as mo.txt, and performed user-information collection and follow-on download behavior. The source does not explicitly attribute the activity to a named DPRK actor in the excerpt, but the targeting and Korean political lures make it relevant to North Korea-focused tracking without over-attribution.