The hackers eventually breached the computer of one of the experts on May 8, the chair of the panel of experts wrote in an email to UN. officials and the UN Security Council's North Korea sanctions committee, known as the 1718 committee.
"The zip file was sent with a highly personalized message which shows the hackers have very detailed insight into the panel's current investigations structure and working methods," read the email, which was sent on May 8.
"As a number of 1718 committee members were targeted in a similar fashion in 2016, I am writing to you all to alert you to this heightened risk," the chair of the panel of experts wrote, describing the attack as part of a "sustained cyber campaign."
Related reading
Another large-scale cyberattack underway: experts
A spokesman for the Italian mission to the United Nations, which chairs the 1718 sanctions committee, said on Friday that a member of the panel of experts had been hacked.
No further details who might be responsible were immediately available.
North Korea's deputy United Nations envoy said on Friday "it is ridiculous" to link Pyongyang with the hacking of the UN panel of experts or the WannaCry "ransomware" cyber attack that started to sweep around the globe more than a week ago.
Cyber security researchers have found technical evidence they said could link North Korea with the WannaCry attack.
Reuters reported on Sunday that North Korea's main spy agency has a special cell called Unit 180 that is likely to have launched some of its most daring and successful cyber attacks, according to defectors, officials and internet security experts.
The UN Security Council first imposed sanctions on North Korea in 2006 and has strengthened the measures in response to the country's five nuclear bomb tests and two long-range rocket launches. Pyongyang is threatening a sixth nuclear test.
A second email by the UN sanctions committee secretary to the 15 Security Council members on May 10 said the U.N. Office of Information and Communications Technology was "conducting an analysis of the affected hard drive."
"Increased vigilance relating to 1718 Committee-related correspondence is therefore advised until data analysis and related investigations are completed," the email read.
