North Korea targeted groupware vendors, not users.

Compromising one vendor grants access to every client using its collaboration software’s trusted update channel.

Researchers in South Korea have not named which vendors or client organizations were compromised.

Sources: The Record