A notorious North Korean hacking syndicate has adopted sophisticated techniques to ensure it deploys malware only against intended targets, making it harder for authorities to get their hands on the group’s malware and analyze it, according to security researchers Thursday.

Seongsu Park, a malware analyst at cybersecurity firm Kaspersky, relayed the findings in a new report detailing the inner workings of the command and control (C2) servers behind the DPRK-backed Kimsuky’s Gold Dragon malware cluster.

According to Park, Kimsuky’s latest innovation is the adoption of “victim verification” techniques in some C2 servers