North Korean cybercriminals appear to have targeted Russia’s foreign ministry with signature malware previously used to steal information from foreign governments, according to a German cybersecurity organization.

Deutsche Cyber-Sicherheitsorganisation (DCSO) said in a blog post on Wednesday that the attackers attempted to build a backdoor into Moscow’s foreign ministry by bundling the Konni malware into what appears to be internal Russian government software.

First observed in use in 2014 as a tool to steal information, the Konni malware is associated with a cybercrime cluster of the same name, which reportedly overlaps with DPRK threat