A suspected North Korea-backed hacking group targeted Russian diplomats with a modified version of known malware ahead of the New Year’s holiday, researchers say, in the latest DPRK cyberespionage attack against its ostensible ally.

According to a report from Cluster25 (C25), the Pyongyang-linked hacking group Konni targeted the “Russian diplomatic sector” through spear-phishing attacks disguised as New Year’s greeting cards. While Konni malware has been known to security researchers since at least 2014, C25 says the latest attack contains a new variant of the group’s usual remote access trojan (RAT) that seems specifically tailored for