Multiple organizations

Date (as written): 02/05/2024
Year: 2024
Country: >1
Actors (as written): APT43 (a.k.a. Kimsuky, Emerald Sleet, Velvet Chollima, and Black Banshee)
Actor pages: APT43
Tags (as written): Attack: Targeted Attack; Target Class: Multiple Industries; Attack Class: Cyber Espionage; Tags: FBI, US Department of State, National Security Agency, NSA, North Korea, Kimsuky. DNS Domain-based Message Authentication, Reporting and Conformance, DMARC, APT43, Emerald Sleet, Velvet Chollima, and Black Banshee

Source entries (2)

FBI/State/NSA Joint Cybersecurity Advisory JCSA-20240502-001 "North Korean Actors Exploit Weak DMARC Security Policies to Mask Spearphishing Efforts" (2024-05-02)

Kimsuky spearphishing posing as journalists/academics using spoofed domains (weak DMARC) · 2024-05-02

The North Korean cyber actors have conducted spearphishing campaigns posing as legitimate journalists, academics, or other experts in East Asian affairs with credible links to North Korean policy circles.

https://www.ic3.gov/CSA/2024/240502.pdf

Hackmageddon cyber attacks timelines (Paolo Passeri)

Multiple organizations · 02/05/2024

The FBI, the US Department of State and the National Security Agency (NSA) reveal that the North Korea-linked Kimsuky group is exploiting poorly configured DNS Domain-based Message Authentication, Reporting and Conformance (DMARC) protocols to pose as legitimate journalists, academics or other experts in East Asian affairs with credible links to North Korean policy circles. [Date Occurred: -; Date Discovered: -]

https://www.hackmageddon.com/2024/08/21/1-15-may-2024-cyber-attacks-timeline/

https://www.infosecurity-magazine.com/news/north-korean-spoofing-journalist/

Suggest a correction on GitHub