UN Panel of Experts S/2022/132
TA406 and TA427 campaigns using false email accounts impersonating individuals and entities
Para 159: “One cybersecurity firm described how “TA406” and “TA427”, cyberactors associated with Kimsuky, had been using false email accounts using the identities of legitimate individuals and entities from countries including the Republic of Korea, the United States and the Russian Federation. A wide range of entities have been targeted by illicit cybercampaigns from these cyberactors of the Democratic People’s Republic of Korea.” (footnote 115: Proofpoint, “Triple threat: North Korea-aligned TA406 scams, spies and steals”)