The Lazarus Group, North Korea’s premier hacking team, appears to have started using ransomware to attack victims and extort money out of them, according to a recent analysis by Kaspersky Labs, a cybersecurity company.

Ransomware attacks typically involve deploying malware on a computer system that blocks access to it unless a ransom is paid. While DPRK hackers have been linked to ransomware attacks before, the tactics have changed — and so have the rules around paying ransoms.