Earth Imp is Trend Micro's designation for a North Korean threat actor whose activity Trend Micro identifies as corresponding to the group tracked elsewhere as Konni. In research on the widespread exploitation of a Windows shortcut file vulnerability used for hidden command execution, Trend Micro's Zero Day Initiative found that Earth Imp was among the state-sponsored groups, primarily North Korean, that abused the flaw for cyber espionage and data theft in campaigns dating back to 2017. Trend Micro observed that Earth Imp crafted unusually large malicious shortcut files, padded with substantial whitespace and junk content, to conceal malicious command-line arguments from victims and evade detection, a technique also used by other North Korea-linked groups such as Earth Manticore. The exploitation of this vulnerability by North Korean actors formed part of a broader pattern of tool and technique sharing observed across North Korea's cyber program.