Darktrace observed a South Korea-focused campaign aligned with DPRK activity that used a JSE file disguised as an HWPX document and government-themed decoys impersonating the Ministry of Personnel Management. The script ran through Windows Script Host, unpacked Base64-encoded content, downloaded legitimate VS Code components into C:\ProgramData, and launched a hidden VS Code tunnel named “bizeugene” for interactive remote access. The generated device code and tunnel token were posted to a compromised South Korean site at yespp.co.kr, with the report listing 115.68.110.73 and an MD5 for the disguised HWPX/JSE sample as IOCs. The activity matters because it shows DPRK-aligned operators abusing trusted developer tooling and Microsoft tunnel infrastructure to reduce malware visibility while enabling payload retrieval and data exfiltration.