The firm believes when a developer was contacted by a “trusted former contractor” in early September, it was really a DPRK actor in disguise.