NNPTGroup corresponds to a self-given persona, "원전반대그룹" (Nuclear [Power Plant] Opposition Group), used by the actor behind the December 2014 breach of Korea Hydro and Nuclear Power (KHNP), in an analysis published in April 2015. The intrusion began with a phishing wave of roughly 5,980 emails sent from 211 compromised accounts, including 55 belonging to former employees, to 3,571 KHNP staff, delivering around 300 pieces of Hangul-word-processor-themed malware, including anti-VM shellcode, MBR- and file-destructive components, and network-attack functionality. Starting December 15, 2014, the persona released stolen KHNP data in five staged waves over about a week through social media and staged online disclosures, seeking public attention around an anti-nuclear narrative. The analysis's technical comparison of phishing-email patterns, command-and-control infrastructure, TeamViewer usage, shellcode, and Hangul-language artifacts linked the intrusion and its malware to the Kimsuky operation, which since 2011 had run cyber-espionage campaigns against South Korean defense, diplomatic, unification, and security-related government bodies, research institutes, and North Korean defectors.