North Korea’s malware ecosystem is presented as a deliberately compartmentalized portfolio built for mission specialization, resilience, and attribution ambiguity. The espionage track, associated in the text with Kimsuky, emphasizes low-noise access, credential collection, mailbox surveillance, document theft, script-heavy loaders, memory-resident backdoors, and abuse of trusted cloud services for command-and-control or staging. The financial track, associated with Lazarus Group, prioritizes rapid monetization against cryptocurrency exchanges, blockchain developers, DeFi platforms, and software supply chains using wallet stealers, browser injectors, clipboard hijacking, compromised packages, and trojanized updates. The report frames this diversity as an adaptation to sanctions, public exposure, takedowns, and stronger defenses, allowing DPRK operators to burn and replace tooling without collapsing the broader program.