A North Korea-linked threat group significantly increased its phishing attacks at the end of 2022, while suddenly diversifying the file types it uses to disguise malware, according to cybersecurity researchers.

In a new report released Wednesday, Proofpoint’s research team says TA444, a threat group that overlaps with the better-known APT38 and Bluenoroff, took on an “upstart mentality” at the end of last year when it began to hide malicious code in a larger array of files.

Proofpoint spokesperson Anthony Suarez told NK Pro that TA444 has also increased attacks against North America-based organizations in the