A newly identified North Korean hacking group has extorted ransoms from small- and mid-sized companies in several countries, security researchers at Microsoft said Thursday.

The group calls itself H0lyGh0st and has since late last year distributed ransomware in a widespread, financially motivated campaign. Once infected, victims’ files are encrypted, followed by a ransom note demanding payment and threatening to publish the stolen data on social media, similar to the DPRK’s WannaCry ransomware attack in 2017 that impacted hundreds of thousands of computer systems.