The group uses booby-trapped websites in an attempt to steal Windows usernames and passwords.
Symantec said the team has been active since at least 2013 and is highly motivated by spying.
Crypto-mining extensions are being used by digital crooks to create virtual money.
Cybersecurity firm Symantec said a North Korean hacking group was behind the WannaCry cyberattack.
A malicious spam campaign seeks to capitalize on fears surrounding the Zika virus.