DarkPlum is an NTT Security Holdings tracking name for a highly active cyber-espionage group linked in its research to the Democratic People's Republic of Korea. NTT described the group publicly in 2024 as combining technical capability with effective social engineering. Its reported targets include government agencies, military organizations, academics, and think tanks in South Korea, Japan, Europe, and the United States. Alongside intelligence collection, the group conducts cryptocurrency theft to finance its activity. NTT's investigation identified phishing campaigns against South Korean academics and think tanks, as well as phishing pages intended to steal cryptocurrency-platform accounts. The group manages a layered operational infrastructure that includes VPN services, intermediate systems, and command-and-control servers, measures intended to strengthen operational security. Analysis of that infrastructure also supported assessment of operational locations, working patterns, and the scale of its campaigns.