Government agencies from Germany and South Korea issued a statement this week about a new campaign targeting experts of the Korean Peninsula. The group behind these attacks is a well-known North Korean threat organization tracked as Kimsuky, also known as Thallium or Konni Group. Active since 2012, this group initially focused on targeting assets from South Korea but has now shifted to include Russia, Europe, United States, and United Nations to their target list. Kimsuky consistently goes after intelligence from foreign policy and national security issues tied to the region, nuclear industry, and sanctions. These actors were also responsible for the 2014 Korean Nuclear Power Co. compromise alongside Operation Stolen Pencil, Operation Kabar Cobra, and Operation Smoke Screen, all which occurred between 2018 and 2019. The recent campaign unveiled that Kimsuky threat actors were spearphishing Korean experts by impersonating administrators. These email correspondences included a malicious payload where a Chromium-based extension was installed on the user’s device unknowingly. Once the user opened their respective mail application, the malicious code would harvest the user’s entire email inbox and upload it to actor-controlled command-and-control servers. CTIX continues to monitor threat actor activity globally and will provide additional updates accordingly.