The KAMS incident involved a malicious HWP document distributed through a notice associated with the Korea healthcare sector, with linked metadata classifying the activity as a watering-hole-style compromise and data-breach event. The available evidence supports a Korea-focused healthcare intrusion but does not identify a specific DPRK actor.