A North Korea-linked threat actor tracked as TA406 has intensified its attacks in 2021, particularly credential harvesting campaigns, Proofpoint reports.
The adversary, which security researchers also refer to as Kimsuky, Thallium, and Konni, has been targeting organizations in sectors such as education, government, media, and research, as well as other industries.
According to Proofpoint, TA406 aligns the most with Kimsuky activity, which the security firm tracks as three different threat actors, namely TA406, TA408 and TA427.
“Our analysts have tracked TA406 campaigns targeting customers since 2018, but the threat actor’s campaigns remained low in volume until the beginning of January 2021,” the company said.
During the first six months of the year, Proofpoint observed weekly attacks aimed at journalists, experts in foreign policy, and nongovernmental organizations (NGOs), especially those linked to activities that impact the Korean Peninsula. Academics and journalists were also targeted.
As part of a March 2021 campaign, TA406 targeted high-ranked elected officials at various governmental institutions, a consulting firm, defense institutions, law enforcement agencies, and economy and finance organizations. TA406 mainly focuses on targets in North America, China, and Russia.
Active since at least 2012, the adversary doesn’t typically employ malware in its attacks, but the espionage campaigns observed in 2021 were characterized by the use of both malware and credential harvesting.
Employed malware families include Amadey, Android Moez, BabyShark, CARROTBAT/CARROTBALL, FatBoy, KONNI, SANNY, and YoreKey. NavRAT and QuasarRAT also appear to have been used.
Just as other North Korean state-sponsored actors, TA406 has been engaged in financially-motivated attacks as well, including sextortion and in the targeting of cryptocurrency, the security researchers say.
“Proofpoint assesses with high confidence that TA406 operates on behalf of the North Korean government. […]Proofpoint anticipates this threat actor will continue to conduct corporate credential theft operations frequently, targeting entities of interest to the North Korean government,” the security firm notes.
Related: North Korean Hackers Targeting IT Supply Chain: Kaspersky
Related: ‘World’s Leading Bank Robbers’: North Korea’s Hacker Army
Related: Here’s How North Korean Hackers Stole Data From Isolated Network Segment
More from Ionut Arghire
- Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats
- ‘Asylum Ambuscade’ Group Hit Thousands in Cybercrime, Espionage Campaigns
- Google Cloud Now Offering $1 Million Cryptomining Protection
- Pharmaceutical Giant Eisai Takes Systems Offline Following Ransomware Attack
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- US, Israel Provide Guidance on Securing Remote Access Software
Latest News
- In Other News: AI Regulation, Layoffs, US Aerospace Attacks, Post-Quantum Encryption
- Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats
- Google Introduces SAIF, a Framework for Secure AI Development and Use
- ‘Asylum Ambuscade’ Group Hit Thousands in Cybercrime, Espionage Campaigns
- Evidence Suggests Ransomware Group Knew About MOVEit Zero-Day Since 2021
- SaaS Ransomware Attack Hit Sharepoint Online Without Using a Compromised Endpoint
- Google Cloud Now Offering $1 Million Cryptomining Protection
- Democrats and Republicans Are Skeptical of US Spying Practices, an AP-NORC Poll Finds
