North Korea has expanded its support of Russia’s war efforts from the battlefield to cyberspace, with state-sponsored hackers carrying out an elaborate phishing campaign to gather strategic intelligence from Ukrainian government entities.

The threat group TA406, also known as “Opal Sleet” and “Konni,” impersonated a fictitious researcher in phishing emails to deliver malware and steal user credentials from Ukrainian targets since February, according to a report published on Tuesday by U.S. cybersecurity firm Proofpoint.

The report comes after Moscow and Pyongyang confirmed in late April that North Korean troops participated in combat operations