A North Korean cybercrime group known for its spear-phishing campaigns has been using a sophisticated new backdoor to gain access to victims’ computers and steal information, according to a South Korean cybersecurity firm.

AhnLab said in a report published on Wednesday that the DPRK threat actor Kimsuky has been distributing the previously undisclosed malware, dubbed “HappyDoor” by security researchers, through malicious email attachments as part of its ongoing cyber espionage operations.

The security company stated that it first observed HappyDoor in 2021, but continued monitoring it over the past three years and noticed that the malware