Kaspersky reported that BlueNoroff, a financially motivated North Korea-linked actor, adopted new delivery methods to bypass Windows Mark-of-the-Web warnings. The campaign used ISO and VHD files, Visual Basic Script, Windows Batch files, executables, and MSI-based stages alongside familiar Word-document and LNK intrusion paths. Observed activity included a UAE victim reached through a malicious Word document, follow-on backdoor use for host fingerprinting and privileged malware installation, and shortcut archives such as a Japanese “new bonus schedule” lure. Infrastructure analysis found more than 70 domains, many impersonating venture-capital firms and banks, indicating sustained interest in Japanese financial and cryptocurrency-related targets.