SEKOIA.IO attributed a surveillance campaign targeting North Korean defectors to Reaper, also known as APT37, after finding two open C2 directories that exposed hosted implants and exfiltrated victim data. The investigation uncovered phishing pages for services including Naver, iCloud, Kakao, Mail.ru and 163.com, plus CHM infection vectors staged from a GitHub repository. Retrieved MSHTA files loaded PowerShell backdoors that persisted via HKCU Run keys and supported command execution and exfiltration, while newer Chinotto Windows DLL variants focused on collecting data from victims. SEKOIA assessed the activity as almost certainly tied to Reaper with high confidence and aligned with DPRK surveillance and counter-intelligence priorities.