North Korean hackers appear to have conducted a monthslong cyberespionage campaign using infected Word documents against high-value South Korean targets, including aerospace and aviation researchers, a cybersecurity firm has found.

Cisco Systems’ cybersecurity division Talos Intelligence announced on Wednesday that it has identified malicious blogs operated since June by Kimsuky, a North Korea-based hacking group known for conducting spear-phishing attacks against foreign policy and national security researchers. 

According to Talos, Kimsuky began with social-engineering ploys to gain targets’ trust. Attackers then sent victims Microsoft Word documents (“maldocs”) containing malicious macros written in the programming language