Symantec reported that the North Korea-linked Stonefly group continued espionage operations against high-value engineering targets, especially organizations holding intellectual property with civilian and military applications. In a February 2022 intrusion against an engineering firm in the energy and military sectors, the attackers likely exploited Log4j on a public-facing VMware View server, then moved through 18 additional systems. The activity used updated Backdoor.Preft/Dtrack tooling, PuTTY PSCP and WinSCP for likely file transfer, Mimikatz, 3proxy, Invoke-TheHash, and Impacket wmiexec.py for credential theft, proxying, and lateral movement. The report matters because it shows Stonefly maintaining a selective North Korean espionage focus on sensitive technology while combining custom malware with public administration and post-exploitation tools.