The Updated APT Playbook: Tales from the Kimsuky threat actor group

Rapit7 team recently ran across some interesting activity that they believe is the work of the Kimsuky threat actor group, also known as Black Banshee or Thallium.

Originating from North Korea and active since at least 2012, Kimsuky focuses primarily on intelligence gathering. The group is known to have targeted South Korean government entities, individuals associated with the Korean peninsula’s unification process, and global experts in various fields relevant to the regime’s interests. In recent years, Kimsuky’s activity has also expanded across the APAC region to impact Japan, Vietnam, Thailand, etc.

Read more…
Source: Rapid7