A North Korean threat actor known for its prolific espionage operations recently carried out a monthslong phishing campaign using content related to defector volunteer activities, luring victims through Facebook, Telegram and email.

In a report published on Monday, South Korean cybersecurity firm Genians attributed the “triple combo” campaign to the DPRK cybercrime group Kimsuky, which frequently targets defense firms and North Korea-related activists and researchers.

According to the researchers, the operation carried out in March and April was part of Kimsuky’s “AppleSeed” campaign, named for one of the group’s signature malware strains, and