North Korean cybercriminals have adopted a new strategy that turns the tables on cybersecurity defenders: actively monitoring to see when researchers expose their criminal infrastructure.

In a report published Thursday, U.S. cybersecurity firm SentinelLabs and internet intelligence platform Validin outlined DPRK-aligned threat actors’ examination of cyber threat intelligence (CTI) information to detect exposure of their digital infrastructure and scout new assets.

Security researchers linked this activity to North Korea’s Contagious Interview cyber espionage campaign, which seeks to steal information from cryptocurrency and technology firms by targeting unsuspecting developers with fake job offers and