North Korean cybercriminals targeted leading DPRK experts and media organizations in a series of phishing attacks toward the end of last year, while laying the groundwork for a new campaign against cybersecurity professionals, according to a U.S. security firm.

In a joint investigation with NK Pro, SentinelLabs attributed the attacks with “high confidence” to North Korean threat group ScarCruft, also known as APT37 and InkySquid, based on similarities to past campaigns and the use of malware associated with the group.

By targeting experts and media organizations with a North Korea focus, the cybercrime group