ESRC reported North Korean-linked phishing emails disguised as a Ministry of Unification inter-Korean relations daily log for February 2022. The campaign targeted North Korea-related experts and workers by spoofing official-looking sender identities and imitating legitimate ministry-related document distribution. Although the message appeared to contain an HWP attachment, the lure instead led users to a malicious URL that requested portal account credentials. After a valid password was entered, the phishing flow displayed a normal HWP document, reducing the chance that victims would realize their account details had been stolen.