A North Korean threat group has launched a cyber-attack campaign utilizing various aspects of social media in order to compromise a target. Denoted as Kumsong 121, this group is switching gears from generic spear-phishing campaigns to using social platforms to befriend the victims(s) enough to get them to download and execute a malicious macro virus within a document. Kumsong 121 has been discovered to be tied and funded by North Korean Intelligence by various research groups. Once one target is compromised, a common tactic, technique, and procedure (TTP) for the Kumsong 121 group is that actors will choose their next targets from the victim’s friends list. Kumsong 121 threat actors leverage a variety of social media platforms including WhatsApp, Facebook, Instagram, or Twitter, some of the most popular media platforms to date. Thus far threat actors have targeted roughly 1,400 individuals through their social media profiles laced with smishing links. Smishing refers to the act of phishing through social media means. Lastly, this campaign seems to only target individuals who possess an Android smartphone device rather than an iOS configured device. Since malicious files are executed on the mobile device, threat actors potentially have access to text messages, contact/address books, location data, sound/video recordings, and pictures. CTAPT will continue to monitor for any key developments on this matter and provide updates accordingly.