TA444 (8)
Events whose actors field, as written by the source, names this.
| Date (as written) | Incident | Country | Actors |
|---|---|---|---|
| late December 2022 | TA444 credential-harvesting phishing (“SendGrid URL”) | multiple Member States | TA444 (“overlaps with BlueNoroff”) |
| 25/01/2023 | Crypto users | ES JP PL UK US | TA444 |
| January 25, 2023 | TA444 cryptocurrency theft (2021-2022) | TA444 (APT38, Bluenoroff, BlackAlicanto, Stardust Chollima, COPERNICIUM) | |
| January 25, 2023 | TA444 OneDrive credential harvesting campaign (early December 2022) | United States and Canada | TA444 |
| May 24, 2023 | TA444 phishing of a US digital banking institution (December 2022, CageyChameleon) | United States | TA444 |
| 03/01/2024 | Multiple organizations within the cryptocurrency and the blockchain industries | >1 | TA444 (a.k.a. Sapphire Sleet, BLUENOROFF, STARDUST CHOLLIMA) |
| 2025-01-14T00:00:00.000Z | ‘JustJoin’ Landing Page Linked to Suspected DPRK Activity Resurfaces | TA444/BlueNoroff | |
| January | ta444-apt-startup-aimed-at-your-funds | TA444 (Overlaps with BlueNoroff) |