SectorA07 is a subgroup designation NSHC's threat intelligence team uses within its broader SectorA cluster of North Korea-linked hacking groups. NSHC first defined SectorA07 in May 2019 as a smaller subgroup carved out of the larger SectorA05 group, assessing it as active mainly for collecting financial information from companies in South Korea and Southeast Asia. Through mid-2019 the group used spear-phishing with Microsoft Word macro-laden documents, a departure from the HWP files favored by other SectorA subgroups, and by July 2019 had added Android-targeted mobile malware. NSHC reports SectorA07 activity expanding into Germany, Russia, France, Japan, Malaysia, China, Hong Kong, and Vietnam through 2020, with the group adopting COVID-19-themed lure documents delivered via malicious Word macro scripts that download further malware from hardcoded attacker infrastructure, and later mixing in HWP files carrying PostScript-based malware, alongside domain-registration email accounts tied to Korean and Russian webmail providers.