SentinelLabs and NK News tracked ScarCruft activity against media organizations and high-profile experts on North Korean affairs, assessing the campaigns with high confidence based on malware, delivery methods, and infrastructure. The observed phishing email impersonated the Institute for North Korean Studies and delivered an archive containing benign HWP and PowerPoint files alongside malicious LNK files disguised as Hanword documents. The LNK chains deliver RokRAT, a ScarCruft backdoor used for surveillance, through oversized shortcut files and multiple executable stages. SentinelLabs also recovered testing-stage malware that used a Kimsuky technical report as a decoy, suggesting planned targeting of threat researchers, cyber policy organizations, and other consumers of threat intelligence.