This Korean analysis describes DPRK-linked malware activity targeting security researchers through fake vulnerability research collaboration and an actor-controlled blog at blog.br0vvnn[.]io. The attack chain used malicious exploit PoC projects whose build process launched DLL payloads through PowerShell and rundll32, then established persistence under registry Run keys and dropped files such as C:\ProgramData\VMware\vmnat-update.bin. The payloads decrypted embedded data, loaded additional DLLs, and contacted C2 URLs including codevexillium.org, dronerc.it, transplugin.io, and fabioluciani.com paths. The source also ties similar logic to Operation North Star job-lure documents that created localdb.db and downloaded final payloads from attacker infrastructure.