Cluster25 traced an April 2022 DPRK-nexus spearphishing campaign against South Korean individuals, noting similarities to the Kitty Phishing operation. The activity used Korean-language Word lures impersonating KRNIC, South Korean security firms, or cryptocurrency brands, and exploited CVE-2017-0199 template injection to fetch a weaponized document from infrastructure such as naveicoipd.tech. Embedded VBA decrypted 32-bit or 64-bit payload URLs, dropped RuntimeBroker.exe under %LOCALAPPDATA%\Microsoft\TokenBroker, and used sandbox and antivirus checks before installing a final payload under C:\ProgramData\Intel\IntelRST.exe with registry persistence. The implant retrieved C2 information from a Dropbox-hosted TXT file, exfiltrated host and antivirus state to the operator domain, and used naveicoip-style DGA domains registered through hosting providers.