We can summarize the correlated indicators in a general form as:  Use of Korean language in the system environment of the developers Reuse of multiple TTPs during operation deployments:     GNUBoard compromised web sites     Multiple malware samples deployed at the same time     A similar organization in the deployment architecture Reliance on public services and watering hole attacks to compromised victims Some code reuse, even when the samples are completely different otherwise Working hours for both matches