Unit 42 identified the Fractured Block campaign using CARROTBAT, a previously unreported dropper that delivered decoy documents themed around South Korea, North Korea, cryptocurrency, exchanges, and political events. The activity included a December 2017 spear-phishing email to a senior British government target using a North Korea diplomacy lure and a DDE technique to download a SYSCON payload. CARROTBAT samples opened embedded decoy files and then used Windows certutil-driven commands to retrieve and execute follow-on payloads, with observed payloads including SYSCON and OceanSalt. Infrastructure pivots connected CARROTBAT to KONNI, SYSCON, and OceanSalt activity, but Unit 42 stated the evidence was not sufficient to attribute all of the activity to one actor with certainty.