Pyongyang-backed hackers known to target individuals working on North Korea issues have been deploying software to steal information and “wiretap” victims, according to a South Korean cybersecurity firm.

AhnLab Security Emergency Response Center (ASEC) said in a report that in May it discovered the DPRK-linked threat group RedEyes, also known as APT37 and ScarCruft, distributing and using an “infostealer” equipped with a backdoor linked to an online repository.

Once installed, the software monitors targeted individuals and steals sensitive data, including by taking screenshots, exfiltrating data from smartphones, keylogging and wiretapping.

ASEC did not