Photo: Evgeny Agoshkov\TASS via Getty Images

North Korea-linked hackers have expanded their campaign to spy on experts researching nuclear deterrence, North Korea’s nuclear submarine program and North Korean economic sanctions, according to research from Prevailion.

The big picture: Countries often use espionage to prepare for upcoming actions like new sanctions, improve their bargaining position by better understanding their adversary's goals, or to see what other people know. This could be an example of any of those.

The North Korea-linked "Kimsuky" group has been previously tied to campaigns targeting South Korean entities and the academic sector. In this campaign, Kimsuky has sent phishing emails with Microsoft Word documents that can implant with malware. To a reader, the documents would appear to be:

  • A U.S. Treasury document granting a sanctions license to the Carnegie Corporation
  • A university affiliate's report on new North Korean ballistic missile submarines
  • Speaker notes from a recent nuclear deterrence conference

While researchers have already publicly discussed the last document being used to hack systems, the first 2 documents potentially show an escalation in the scope of the campaign.

  • The malware Kimsuky uses checks has been recently upgraded. The malware has added abilities to detect new antivirus programs, and now hides some of its coding in an obscure image file format that antivirus programs might not check.

Go deeper

Updated 2 hours ago - Politics & Policy

Coronavirus dashboard

Illustration: Aïda Amer/Axios

  1. Politics: Pence chief of staff Marc Short tests positive for coronavirus — COVID-19 looms over White House Halloween celebrations
  2. Health: Fauci says maybe we should mandate masks if people don't wear them — America was sick well before it ever got COVID-19
  3. World: Polish President Andrzej Duda tests positive for COVID-19.

Pence chief of staff Marc Short tests positive for coronavirus

Marc Short with Katie Miller, Vice President Pence's communications director, in March. Photo: Doug Mills/The New York Times via Reuters

Marc Short, Vice President Mike Pence’s chief of staff, tested positive for the coronavirus Saturday and is quarantining, according to a White House statement.

Why it matters: Short is Pence's closest aide, and was one of the most powerful forces on the White House coronavirus task force.

5 hours ago - World

Opposition leader Leopoldo López flees Venezuela

Venezuelan opposition politician Leopoldo López outside the Spanish embassy in Caracas, in 2019. Photo: Juan Barreto/AFP via Getty Images

Leopoldo López, a former political prisoner and prominent Venezuelan opposition leader, has left the country, his Popular Will party confirmed in a statement Saturday.

Why it matters: He's been an influential force in the push to oust President Nicolás Maduro's regime and a mentor to opposition leader Juan Guaidó. He'd been in the Spanish ambassador's Caracas residence since escaping house arrest in April 2019 following a failed military uprising.