North Korea-aligned hackers are spoofing financial institutions and venture capital (VC) firms in the U.S. and Asia as part of ongoing attempts to fund regime activities, potentially including nuclear and missile development, according to a U.S. cybersecurity company.

The attackers, dubbed Threat Activity Group 71 (TAG-71), mimicked dozens of domains that mostly redirected visitors to the legitimate website of the service being spoofed, Recorded Future’s Insikt Group threat research division states in a report released Tuesday. This infrastructure also hosted six files, with at least two designed to communicate with the hackers after deployment.[/p