DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

TA427 (3)

Events whose actors field, as written by the source, names this.

Date (as written)IncidentCountryActors
April 16, 2024TA427 benign-conversation phishing of foreign policy experts with DMARC abuse (since 2023)US; Republic of Korea (ROK or South Korea)TA427 (Emerald Sleet, APT43, THALLIUM, Kimsuky)
22/04/2024Multiple organizations in South KoreaKRTA427, a.k.a. Emerald Sleet, APT43, THALLIUM or Kimsuky.
April 17, 2025TA427 ClickFix campaign against think tanks; Japanese diplomat impersonation (January-February 2025)Washington, DC; South Korea (infrastructure)TA427 (Kimsuky / Emerald Sleet)