There's a Korean saying: 재주는 곰이 부리고 돈은 주인이 받는다 "the bear does the tricks, but the owner takes the money." It fits the DPRK perfectly: operators run the heists, the regime takes the crypto.
This talk turns that drama into a purple team tabletop you can run next week. The focus is methodology and mindset, not tooling. Tabletops fail when they drill the technology but never train the humans.
We fix that by building the exercise around real procedures from a DPRK campaign: the fake recruiter, the trojanized coding assessment, the staged loader-then-RAT, the wallet drain. Each procedure runs as a red-describes / blue-responds exchange: red narrates how the technique actually executes, blue calls the detection, the data source, and the gap.
You'll learn a repeatable method: select a DPRK threat profile, decompose it into MITRE ATT&CK-mapped procedures, and design branching injects that force real decisions under pressure.
The goal is to develop analyst instinct by teaching people to think in adversary procedures before they reach for a console.
You'll leave with a framework and templates to anchor your first procedure-based exercise to the DPRK behaviors that target your sector and a room that's been trained to think, not just click.
