CL-STA-0237 is a North Korean IT-worker activity cluster assessed to operate likely from Laos while using Lao network access and identities. The cluster obtained employment at a major technology company in 2022 and abused a U.S. IT-services business as a platform for additional job applications. It was later linked to phishing with malware-infected video-conferencing applications, marking a shift from income-generating employment fraud toward more aggressive malware activity within a broader network supporting North Korean state objectives.