SHROUDED#SLEEP was an ongoing cyber-espionage campaign disclosed in October 2024 and likely attributed to North Korea’s APT37, also known as Reaper or Group123. It targeted Southeast Asia, with Cambodia assessed as the primary focus based on lure language, country themes, and related telemetry. Victims were likely approached with phishing emails carrying compressed file attachments. The campaign delivered VeilShell, a stealthy PowerShell-based implant, through an evasive multi-stage chain. Similarities to activity seen in 2023 suggested that the operator had either retooled and resumed operations or remained active without detection.