Security researchers have uncovered new details surrounding a North Korean campaign against energy providers around the world, shedding light on how the country’s most infamous hacking syndicate has deployed a slate of new-and-improved malware to burrow itself into victims’ systems. 

Analysts at Cisco Talos announced the findings Thursday in a pair of blog posts detailing the Lazarus Group’s efforts to distribute three distinct malware snippets, one of which has flown under the radar until now.

The campaign, initially uncovered in April and May by security firms AhnLabs and Symantec, began around February and