An unknown threat group is operating a significant spear-phishing campaign against higher education institutions and their employees. These attacks have been observed being sent to professors at universities and loaded with malicious email attachments claiming that the associated documents are related to North Korean paper requirements. Analysis of some captured emails include similar file naming structure to “{Month} Monthly KIMA Paper_Requirements.doc”. Additionally, KIMA is a popular magazine published by the Korean Institute for Military Affairs relaying information in security, military, and defense industries. The attached documents are macro-enabled documents that upon execution reach out to threat actor command-and-control (C2) servers where malicious code is downloaded and deploying them from random access memory. The malicious scripts gather a wide variety of system information from the infected host ranging from computer hostname, model, OS type, and owner information to anti-malware configurations, recent office documents, file listing, and hardware information. Information is extracted back to the C2 server where the threat actors receive the collected information. CTIX will continue to monitor any additional fallout from this campaign and update accordingly.