ARCHIPELAGO (subset of APT43) phishing of North Korea policy experts

CSIS Significant Cyber Incidents

North Korean-linked hackers targeted people with expertise on North Korea policy issues in a phishing campaign. Hackers posed as journalists requesting interviews from targets, inviting them to use embedded links for scheduling and stealing their login credentials. The amount of information stolen and number of targets are unclear.

CFR Cyber Operations Tracker

In a recent phishing campaign, North Korean threat actor Kimsuky posed as media outlets and think tanks and requested interviews or information about North Korea. The emails contained malicious links redirecting to fake login pages that harvested user credentials.

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers from Google warn of the North Korea-linked ARCHIPELAGO (subset of the APT43 group) targeting government and military personnel, think tanks, policy makers, academics, and researchers in South Korea, the US and elsewhere. [Date Occurred: During Late 2022; Date Discovered: During Late 2022]

Google Threat Analysis Group (TAG) blog

TAG began tracking ARCHIPELAGO in 2012 and has observed the group target individuals with expertise in North Korea policy issues such as sanctions, human rights and non-proliferation issues. These targets include Google and non-Google accounts belonging to government and military personnel, think tanks, policy makers, academics, and researchers in South Korea, the US and elsewhere.

Suspected victims: Government and military personnel, think tanks, policymakers, academics, and researchers in South Korea and the United States

In a recent phishing campaign, North Korean threat actor Kimsuky posed as media outlets and think tanks and requested interviews or information about North Korea.