TA427 benign-conversation phishing of foreign policy experts with DMARC abuse (since 2023)

Date (as written): April 16, 2024
Year: 2024
Country: US; Republic of Korea (ROK or South Korea)
Actors (as written): TA427 (Emerald Sleet, APT43, THALLIUM, Kimsuky)
Actor pages: TA427
Tags (as written): foreign policy experts; think tanks; NGOs

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Foreign policy experts for insight into US and the Republic of Korea · 16/04/2024

Researchers from Proofpoint reveal the details of a campaign orchestrated by threat actors aligned with North Korea and targeting foreign policy experts for insight into US and the Republic of Korea. [Date Occurred: Since December 2023; Date Discovered: Since December 2024]

https://www.hackmageddon.com/2024/07/30/16-30-april-2024-cyber-attacks-timeline/

https://www.infosecurity-magazine.com/news/kimsuky-exploits-dmarc-web-beacons/

Proofpoint Threat Insight

TA427 benign-conversation phishing of foreign policy experts with DMARC abuse (since 2023) · April 16, 2024

Since 2023, TA427 has directly solicited foreign policy experts for their opinions on nuclear disarmament, US-ROK policies, and sanction topics via benign conversation starting emails.

https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering

Suggest a correction on GitHub