ANY.RUN Sandbox is an interactive malware analysis environment that allows security teams to safely observe suspicious files, links, and tools in a controlled setting. In this investigation, it was used to monitor suspected DPRK operatives' activity in real time.