You can see that in addition to the code, the author copy-pasted English typos such as "IE Registery":PDB PathsWe can clearly identify a pattern in the PDB naming convention of all the binaries mentioned in this article.ROKRAT:e:\Happy\Work\Source\version 12\T+M\Result\DocPrint.pdb (from the "Evil New Year" campaign)d:\HighSchool\version 13\2ndBD\T+M\T+M\Result\DocPrint.pdb (from the "North Korean Human Rights" campaignD:\HighSchool\version 13\First-Dragon(VS2015)\Sample\Release\DogCall.pdb (ROKRAT Sample from an unidentified campaign from June)Wiper:D:\HighSchool\version 13\VC2008(Version15)\T+M\T+M\TMProject\Release\ErasePartition.pdb (From the "Are You Happy?" campaign)Summary GraphHere is a graph to visualize the similarities and differences between each campaign mentioned in this article:ConclusionSouth Korea is becoming an important target for malicious actors and the techniques used are becoming specific to the region (for example: use of native language to try and ensure the targets feel that the information, document or email being sent to them has added legitimacy)