NSHC's May 2024 threat actor intelligence report summarizes activity collected by the ThreatRecon team across several tracked intrusion clusters. The report states that SectorA groups were observed in many countries and describes job-recruitment social engineering on platforms such as LinkedIn against software developers and other targets. The activity aligns with North Korea-linked tradecraft that uses recruiter personas, malicious files, and staged payload execution to gain access, collect host information, and support follow-on operations.