A North Korean cybercrime group known for its prolific phishing operations has added two new malware programs to its growing arsenal of tools to steal information, according to a U.S. cybersecurity firm.

In a report published on Thursday, Palo Alto Networks’ United 42 threat intelligence team stated that it discovered a previously unknown keylogger and a new variant of a previously recorded backdoor that grants attackers access to targeted systems.

The security firm stated that this campaign’s targets were mostly in South Korea and Japan, aligning with Kimsuky’s history of targeting ROK government