Hunt.io identifies additional SparkRAT infrastructure tied to a suspected DPRK macOS campaign previously observed using fake meeting-themed lures. The activity includes open directories serving bash scripts and Mach-O SparkRAT clients, with delivery paths that download client.bin, save it under /Users/shared, set broad execute permissions, and run it in the background. SparkRAT communications rely on WebSocket and HTTP behavior, including default port 8000 panels, Basic Authentication prompts, and update-check responses that can help defenders fingerprint active C2 servers. The investigation lists infrastructure in South Korea and Singapore, including UCLOUD and OVH-hosted IPs, Namecheap-registered domains, Let's Encrypt certificates, and a related Vietnamese-language gaming-themed site used around the same C2 ecosystem.