North Korea hackers spy on nuclear, sanctions experts: report

The North Korea-linked "Kimsuky" group has been previously tied to campaigns targeting South Korean entities and the academic sector. In this campaign, Kimsuky has sent phishing emails with Microsoft Word documents that can implant with malware. To a reader, the documents would appear to be:

• A U.S. Treasury document granting a sanctions license to the Carnegie Corporation
• A university affiliate's report on new North Korean ballistic missile submarines
• Speaker notes from a recent nuclear deterrence conference

While researchers have already publicly discussed the last document being used to hack systems, the first 2 documents potentially show an escalation in the scope of the campaign.

• The malware Kimsuky uses checks has been recently upgraded. The malware has added abilities to detect new antivirus programs, and now hides some of its coding in an obscure image file format that antivirus programs might not check.