South Korean research collective IssueMakersLab tracked RGB-D5, a North Korean state threat actor under the Reconnaissance General Bureau that its reporting treats as equivalent to, or inclusive of, the actor commonly called Kimsuky, through a series of short posts issued between April and December 2020. The earliest post described a 'Daily Coffee' operation in which the actor launched spearphishing attacks against dozens to hundreds of South Korean key figures on a near-daily basis. A following post detailed RGB-D5's distribution of Android malware built from an open-source Android remote access tool to South Korean targets. IssueMakersLab also distinguished RGB-D5 from a related cluster it labeled RGB-D3 by target set within the defense-contractor sector: RGB-D3 focused on aerospace and defense firms, while RGB-D5 primarily targeted companies producing artillery ammunition and military vehicles. Later in 2020, RGB-D5 was linked to attacks on COVID-19 vaccine pharmaceutical developers and the World Health Organization across the United States, South Korea, Germany, Sweden, and the United Kingdom, and to a spearphishing campaign against more than 40 South Korean companies, universities, financial institutions, law firms, and media organizations.