Several hacking groups sponsored by the State of Iran, North Korea and Russia, were found by taking advantage of the increasingly popular social engineering tactics to deploy malware over a period of three months from the end of 2024 at the beginning of 2025. The phishing campaigns adopting the strategy were attributed to clusters followed as TA427 (Akak KIMSUK), TA450 (AKA WIDDYWATER, (AKA KIMSUK), TA450 (También conocido como Widdywater, (también conocido como Kimsuk), TA450 (también conocido como Widdywater, (también conocido como Kimsuk), Ta450 (también conocido como Widdywater,
