Financial institutions and venture capital firms in Japan, Vietnam, and the United States · 06/06/2023
Researchers from Recorded Future discover a cluster of malicious activity spoofing several financial institutions and venture capital firms in Japan, Vietnam, and the United States, carried out by Threat Activity Group 71 (TAG-71), with significant overlaps with the North Korean state-sponsored APT38. [Date Occurred: Between September 2022 to March 2023; Date Discovered: -]
North Korea-Aligned TAG-71 Spoofs Financial Institutions in Asia and US · May
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 23 of 75, PDF p. 323). DPRK cyber actor: BlueNoroff; Report Name: North Korea-Aligned TAG-71 Spoofs Financial Institutions in Asia and US; Case Summary: BlueNoroff spoofed several financial institutions and venture capital firms in Japan, Vietnam, and the United States in late 2022 and early 2023. Previous reporting also found similar activity, with DPRK cyberthreat actors spoofing domains belonging to financial firms located in a number of countries, as well as popular cloud services used by a large number of enterprises.; Publication Month: May
https://www.recordedfuture.com/north-korea-aligned-tag-71-spoofs-financial-institutions · June
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 26 of 75, PDF p. 323). DPRK cyber actor: BlueNoroff; Report Name: https://www.recordedfuture.com/north-korea-aligned-tag-71-spoofs-financial-institutions; Case Summary: BlueNoroff carried out malicious cyber threat activity spoofing several financial institutions and venture capital firms in Japan, Vietnam, and the U.S. in late 2022 and early 2023.; Publication Month: June
Spoofing of financial institutions and venture capital firms in Japan, Viet Nam and the United States
Para 189: “BlueNoroff actors were spoofing financial institutions and venture capital firms in Japan, Viet Nam and the United States to trick potential victims into opening malicious content or providing login credentials (see annex 100).”
North Korea-Aligned TAG-71 Spoofs Financial Institutions in Asia and US · (no date on page)
Insikt Group has discovered malicious cyber threat activity spoofing several financial institutions and venture capital firms in Japan, Vietnam, and the United States. The group responsible, referred to as Threat Activity Group 71 (TAG-71), has significant overlaps with the North Korean state-sponsored APT38. Between September 2022 and March 2023, Insikt Group discovered 74 domains and 6 malicious files associated with TAG-71's activities.