A North Korean cybercrime group known for its prolific phishing operations appears to be expanding its scope with a new campaign aimed at Japan, according to a Japanese cybersecurity organization.

The Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) reported in a blog post on Monday that it observed the DPRK threat actor Kimsuky targeting Japanese organizations in March by posing as “a security and diplomatic organization.”

The report did not identify the target of Kimsuky’s phishing campaign or which entity it impersonated, but U.S. security firm Proofpoint previously reported that the