TA406Threat actor
TA406 is engaging in malware distribution, phishing, intelligence collection, and cryptocurrency theft, resulting in a wide range of criminal activities.From MISP Galaxy
Last reported 1 month ago, by SOCRadar2 reports
ATT&CK techniques
6 of 26 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1016System Network Configuration Discovery
“T1016”
- T1036Masquerading
“These archives contained LNK files masquerading as PDFs, using lures focused on global food price growth due to the Strait of Hormuz situation, Russia-Ukraine peace negotiation frameworks, and social researcher resumes to deceive targets.”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1036.007Double File Extension
“T1036.007”
- T1041Exfiltration Over C2 Channel
“T1041”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures“Konni (also tracked as TA406 and Opal Sleet) is a DPRK-nexus threat actor primarily tasked with strategic intelligence collection since at least 2014.”
-
Beyond Lazarus: How North Korea Organizes Its Cyber Operations“…ing an increase in the number of operators, Kimsuky is regarded by some DPRK experts as a mega-cluster comprising several branches, like TA406 and TA408 among others.”
Indicators in its reports
named in the reports above- 23.237.102[.]130in 1 report
- 37.120.154[.]98in 1 report
- 38.75.137[.]97in 1 report
- 45.86.208[.]162in 1 report
- 50.7.159[.]34in 1 report
- 91.239.130[.]102in 1 report
- 103.214.44[.]138in 1 report
- 167.88.61[.]117in 1 report
- 185.135.76[.]89in 1 report
- 188.43.33[.]252in 1 report
- 211.21.6[.]181in 1 report
- 70.32.3[.]15in 1 report
- 66.118.255[.]35in 1 report
- hxxps://www.hrnk[.]org/documentations/the-reconnaissance-general-bureau-the-kim-regimes-precious-treasured-sword/in 1 report
- www.hrnk[.]orgin 1 report
- hxxps://ieeexplore.ieee[.]org/document/8756954/in 1 report
- hxxps://www.kinu.or[.]kr/eng/module/report/view.do?idx=125351&nav_code=eng1674806000in 1 report
- www.kinu.or[.]krin 1 report
- hxxps://www.csis[.]org/analysis/hidden-enablers-third-countries-north-koreas-cyber-playbookin 1 report
- hxxps://understandingwar[.]org/research/china-taiwan/north-koreas-constitutional-amendments-cement-the-regimes-strategic-posture/in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.