> In late January of 2021, he opened a file sent to him by a fellow hacker, who had described it as an exploitation tool. Just 24 hours later, he spotted a blog post from Google Threat Analysis Group warning that North Korean hackers were targeting security researchers. Sure enough, when P4x scrutinized the hacking tool he'd received from a stranger, he saw that it contained a backdoor designed to provide a remote foothold on his computer. P4x had opened the file in a virtual machine, digitally quarantining it from the rest of his system. But he was nonetheless shocked and appalled by the realization that he'd been personally targeted by North Korea.

The article specifically states he received it "from a stranger", not a friend, which suggests that he was indeed personally targeted. Yes, it does say "fellow hacker", but again this is obviously not someone he knows because it's a "stranger".

I guess it comes down to your definition of "personally targeted". Sure, this isn't a spearphishing campaign, but according to Google's blog writeup about these events [1], they basically targeted individual researchers:

> The actors have been observed targeting specific security researchers by a novel social engineering method. After establishing initial communications, the actors would ask the targeted researcher if they wanted to collaborate on vulnerability research together...

[1] https://blog.google/threat-analysis-group/new-campaign-targe...

You're amplifying their propaganda.

The whole reason why NK repeatedly tests nuclear and conventional strike capabilities is to power project, get people to the negotiating table, and try to get supplies/food/money from countries in exchange for a halt of testing.

[1] - https://www.wired.com/story/eternalblue-leaked-nsa-spy-tool-...

Calling it a "bear" is utilizing the common expression "Don't poke the bear," not an assessment of North Korea's abilities.