PwC publicly profiled Black Dev 2 in September 2021 as an emerging North Korea-based threat actor hunting cryptocurrency and running the continuing Operation Gold Hunting campaign. The group formed part of a financially motivated activity set whose focus expanded from cryptocurrency-wallet heists to venture-capital and investment firms across multiple regions. PwC characterized its access activity through spearphishing themes and highlighted the malicious documents and infrastructure used in its campaigns. This combination of targeted social engineering, document-based delivery, and purpose-built supporting infrastructure was intended to compromise organizations connected to cryptocurrency and investment activity. At the time of publication, PwC noted that Black Dev 2 had received little open-source coverage, making the label a vendor-specific tracking name rather than a broadly defined public actor identity.