A group of North Korean state-sponsored hackers has reportedly attempted to attack defense industry companies from Russia, a longstanding ally of North Korea. 

The Russian daily Kommersant reported on Monday citing cybersecurity experts that that the hackers’ group, called Kimsuky, made several attacks this year on Russian aerospace and defense companies, including Rostec, a state-run company supporting the production and export of weapons. 

The group reportedly launched the attacks to secure confidential information about the target companies and used phishing emails disguised as messages that appeared to be COVID-19 notices or job placement ads. 

Kimsuky is also known by other names, such as Velvet Chollima and Black Banshee, and allegedly receives support from the North Korean government. It is also working together with leading North Korean hackers’ group, Lazarus. 

Kommersant said the Kimsuky group mainly targeted organizations in South Korea during the early phase of its operations since 2010, but later expanded attacks targeting companies in other countries, including Russia, Ukraine, Slovakia and Turkey.