Unit 42 maps North Korean cyber activity to RGB-linked clusters rather than treating all public reporting as a single Lazarus label. The assessment separates Alluring Pisces, Gleaming Pisces, Jumpy Pisces, Selective Pisces, Slow Pisces, and Sparkling Pisces, covering missions that include espionage, financial theft, destructive attacks, cryptocurrency targeting, and ransomware activity. It also reviews recently active DPRK malware across Windows, macOS, and Linux, including RustBucket as an Alluring Pisces macOS backdoor, and frames the material around defenses and MITRE ATT&CK evaluation coverage.