NSHC’s April 2022 threat actor intelligence report lists four SectorA groups and says their activity was observed in Brazil, Germany, the United States, South Korea, Japan, China, Austria, the United Kingdom and Canada. SectorA01 impersonated corporate recruiters and sent spear-phishing emails to people in finance, news and IT, while SectorA05 impersonated a broadcaster and targeted North Korean human rights organizations and activists. SectorA06 used CHM files, and SectorA07 sent spear-phishing emails impersonating specific companies with Word attachments themed around customer information, loans, tax evasion reports, lawsuits and contracts. The report says continuing SectorA operations seek high-value information related to Korean political, diplomatic and government activity while also pursuing financial gain worldwide.