DPRK-linked activity accounted for $655,000 in losses during the week. A UNC1069 fake Microsoft Teams call caused a $385,000 loss, while a separate $270,000 seed compromise was suspected to involve DPRK actors. SEAL identified three UNC1069 phishing domains and connected a domain and IP address from older command-and-control infrastructure to the actor's new phishing deployments.