Targeting of the International Atomic Energy Agency and South Korean defense contractor · Feb 2022
The North Korean threat actor Kimsuky used spear-phishing techniques to masquerade as websites and applications to get victims to input their credentials. The victims included a security officer at the International Atomic Energy Agency.
Kimsuky phishing infrastructure; targeting of the International Atomic Energy Agency
Para 156: “The Panel was informed that Kimsuky was capable of setting up phishing infrastructure to mimic well-known websites and applications (e.g. Microsoft Outlook) and to trick victims into entering their credentials. These stolen credentials are used by the actor to perform targeted attacks. A cybersecurity firm reported that in one of the cases the actor collected email addresses not only of government entities but also of those associated with a security officer at the International Atomic Energy Agency. According to the same cybersecurity firm, Kimsuky is believed to have later used this information to perform its targeted attacks against the Agency.”