A North Korean threat actor known for carrying out cyberespionage and extortion campaigns may have joined forces with an underground cybercrime collective for the first time to deploy ransomware, according to a U.S. cybersecurity firm.

Palo Alto Networks’ Unit 42 threat research team warned in a report on Wednesday that the collaboration between Andariel and the Play ransomware group could herald a new trend in global campaigns, representing a shift in approach for the DPRK state-backed actor that it tracks under the name “Jumpy Pisces.”

Play, which Unit 42 calls “Fiddling Scorpius,” is associated with the