Props to https://www.sentinelone.com/labs/macos-nimdoor-dprk-threat-a... for analyzing the hack in great detail.