Tencent Yujian reports a suspected Group123/APT37 phishing campaign observed from late August to mid-September 2019 against people likely connected to China-South Korea trade. The attack used RAR archive lures with Korean-themed filenames and executables disguised as Word documents, then downloaded a disguised JPG from artmuseums.or.kr that decrypted into a RAT installed as svchost.exe. The RAT collected host information and document lists, including Korean HWP files, while an additional module read C2 data from aconfig.ini and dropped a WinRAR command-line component. Tencent assesses the activity as likely Group123 based on the target profile, Korean-language artifacts, Korea-related compromised C2 infrastructure, and similarities to previously reported ScarCruft/Group123 tradecraft, while noting some overlap with Darkhotel-style behavior.