A hacking group known to target DPRK watchers compromised a “pro-North Korea” website late last year to distribute malware to visitors, security researchers say, though it’s unclear whether the attackers have links to Pyongyang.

According to a Trend Micro report published Friday, a group dubbed Earth Kitsune modified the website of an unspecified pro-North Korean organization to display an error message that prompts visitors to download a trojanized installer to watch videos on the site. 

This installer in turn loads a backdoor that can perform various functions including deleting, listing, downloading and uploading files