Microsoft attributed a campaign targeting security researchers to ZINC, a DPRK-affiliated state-sponsored group, after detecting attacks against penetration testers, private offensive researchers, and employees at security and technology companies. The operators built credibility through Twitter, LinkedIn, GitHub, and an actor-controlled blog before moving responsive targets to other channels and sending malicious Visual Studio projects. Microsoft also observed a watering-hole path through br0vvnn[.]io where visitors using Chrome were followed by ZINC malware activity, suggesting an exploit chain even on fully patched systems. The Visual Studio projects used pre-build PowerShell commands to execute Comebacker DLL payloads via rundll32 and establish command-and-control access.