Spearphishing targeted at five permanent missions of UN Security Council member countries (ANSSI report)

Date (as written): August 2019
Year: 2019
Country: China; France; Belgium; Peru; South Africa (permanent missions)
Actors (as written): Kimsuky and Group123 (technical links per ANSSI)
Actor pages: Kimsuky and Group123
Tags (as written): spearphishing; credential gathering

Source entries (2)

UN Panel of Experts S/2020/151

Spearphishing targeted at five permanent missions of UN Security Council member countries (ANSSI report) · August 2019

Para 115: “In September 2019, the National Cybersecurity Agency of France issued a public report on malicious activity (spearphishing) observed in August 2019 and targeted at five permanent missions of the “member countries of the United Nations Security Council (China, France, Belgium, Peru, South Africa)”, pointing out the “technical links” found during the Agency’s investigations “between some infrastructure used during these attacks and technical elements reported in open-sources as being used by the following threat actors: Kimsuky and Group123”.”

https://undocs.org/S/2020/151

UN Panel of Experts S/2020/151

Spearphishing emails with fake Security Council briefing “concept note” · 4 August 2019

Footnote 151: “In one instance, on 4 August 2019, cyberactors of Kimsuky Group of the Democratic People’s Republic of Korea sent to at least eight official and personal email addresses associated with current or former members of the United Nations and the Security Council spearphishing emails that contained a file appearing to pertain to a briefing for the Council. The spearphishing email attachment was described as a “concept note” for a Council briefing, scheduled for later in August 2019 ...” (see annex 28)

https://undocs.org/S/2020/151

Suggest a correction on GitHub