The research tracks UNC3782 infrastructure first pivoted from Mandiant-shared indicators and finds extensive phishing activity impersonating Naver Corp from 2021 through late 2022. The author identifies hundreds of Naver typosquat domains, WHOIS registration patterns, and operator email addresses, including repeated personas and Hostinger-linked accounts used across related domains. The cluster later registered cryptocurrency-themed domains, including NFT and crypto names that were still live in the observed 2025 window, marking a shift from the earlier Naver-focused targeting. The report also notes overlap seen by Mandiant with DPRK APT43/Kimsuky but explicitly says it remains unclear whether UNC3782 is APT43, so the evidence is most useful as infrastructure and phishing-tradecraft tracking rather than definitive attribution.