Norfolk Infosec reviewed open-source evidence supporting BAE Systems’ SAS2019 reporting on DPRK-attributed SWIFT heist activity, including a PowerShell backdoor dubbed PowerBrace and possible overlap with TA505 intrusions. The source ties DPRK-linked financial-sector IOCs, the PSLogger keylogger, and several similar PowerShell samples through infrastructure overlaps and VirusTotal submission patterns, including a Pakistan submitter associated with both PSLogger and a PowerBrace candidate. The report assesses that the listed PowerShell scripts likely belong to the same DPRK-attributable malware family described by BAE, while providing selected MD5 indicators and analysis notes rather than a full reverse-engineering write-up.