IBM X-Force reports that ITG10, whose TTPs overlap APT37 and ScarCruft, likely ran an April 2023 phishing campaign against South Korean government, communications, education, think-tank, dissident, and foreign-policy targets. The campaign used ZIP attachments containing LNK files disguised as documents, including Korean parliamentary and seminar lures plus energy and construction-themed decoys, to drop shortcut files with obfuscated PowerShell. The PowerShell chain downloaded second-stage RokRAT shellcode, a payload capable of C2 command execution, data exfiltration, file transfer, and keylogging. X-Force links the lure themes to DPRK interests around the Korean peninsula and South Korean overseas construction and energy ties.