ReversingLabs blog
Thallium abuse of stock investment platform installer (in "SSCS attacks: A (partial) history") · 2024-01-16T06:00:00.000Z
The North Korean APT group known as Thallium exploited the legitimate installer of the stock investment platform by injecting specific commands that fetched a malicious XSL script from a rogue FTP server, and executed it on Windows systems via the in-built wmic.exe utility.