A North Korean cyber espionage campaign involved more malware than previously understood, security researchers said Wednesday, featuring capabilities such as exfiltrating passwords, screenshots and keystrokes to the attackers through Google Drive.

The malware, which researchers at ESET Security dub Dolphin in a new report, is the next-stage payload of Bluelight, a backdoor previously uncovered by security firm Volexity in Aug. 2021. 

At the time, Volexity said North Korea-focused outlet DailyNK had been infected with Bluelight, suggesting attackers may have deployed Dolphin on the company’s systems, too.

“While the Bluelight backdoor performs basic reconnaissance