IronNet’s Black Hat NOC hunters observed numerous callouts from four unique hosts to three domains associated with SHARPEXT, malware that Volexity had linked to the North Korean APT Kimsuky, also tracked as SharpTongue. The finding occurred in a noisy conference network where defenders had to distinguish real malware from training and demo traffic, making known APT infrastructure especially important for triage. The source frames the SHARPEXT activity as one of several genuine infections detected during the event, alongside unrelated Shlayer and NetSupport RAT cases. For DPRK-focused tracking, the key evidence is the presence of North Korean-attributed SHARPEXT network activity on multiple hosts in the Black Hat environment.