APT37 is reported targeting journalists and security researchers with malicious Hangul Word Processor documents themed around COVID-19 vaccine disinformation and Upbit policy changes. The analyzed HWP lures contain embedded files, shellcode, PE files, and base64-encoded PowerShell that spawn command interpreters and use HTTP POST requests for command-and-control. The PowerShell downloads additional plugins into the APPDATA folder from C2 paths including ljs5950[.]cafe24[.]com/bbs/samsung/do[.]php and kjdnc[.]gp114[.]net/data/log/do[.]php. The activity maps to spearphishing attachments, PowerShell and Windows command execution, registry and system discovery, persistence via Run keys or startup folders, and web-protocol C2, making it relevant for tracking DPRK-linked targeting of researchers and media.