www.proofpoint.com Open in urlscan Pro
2a02:e980:107::cf  Public Scan

Form analysis
4 forms found in the DOM

<form class="header-nav__search-form">
  <input type="text" class="header-nav__search-input" placeholder="">
  <input type="submit" class="header-nav__search-button" val="Search">
</form>

<form id="mktoForm_19277" data-mkto-id="19277" data-mkto-base="//app-abj.marketo.com" data-munchkin-id="309-RHV-619" data-submit-text="" data-redirect-link="" data-prefill="" data-event-label="" data-lang-code="us" data-validate-email="1"
  class="mk-form__form marketo-form-block__form mktoForm mktoHasWidth mktoLayoutLeft js-visible mkto-form-processed" data-asset-type="Blogs Subscribe" novalidate="novalidate"
  style="font-family: inherit; font-size: 16px; color: rgb(51, 51, 51); width: 1601px;">
  <style type="text/css"></style>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 150px;">
          <div class="mktoAsterix">*</div>Business Email:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Business Email  *" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
          class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 200px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="blogInterest" class="mktoField mktoFieldDescriptor mktoFormCol" value="All Blog Posts" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Employees_Picklist__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="State" class="mktoField mktoFieldDescriptor mktoFormCol" value="State/Province" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Most_Recent_Medium__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="Website" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Most_Recent_Medium_Detail__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="www-pfpt" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Industry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Website" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="AnnualRevenue" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbasesid" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandBase_Data_Source" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Primary_Product_Interest__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="UTM_Post_ID__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="utmcampaign" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="utmterm" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="db_employee_count" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Unsubscribed" class="mktoField mktoFieldDescriptor mktoFormCol" value="0" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Submit</button></span></div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor"
    value="19277" placeholder=""><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="309-RHV-619" placeholder=""><input type="hidden" name="Website_Conversion_URL__c" class="mktoField mktoFieldDescriptor"
    value="https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering" placeholder=""><input type="hidden" name="gAClientID" class="mktoField mktoFieldDescriptor" value="1332484325.1715846240"
    placeholder="">
  <style type="text/css"></style>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 150px;">
          <div class="mktoAsterix">*</div>Business Email:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Business Email *" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
          class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 200px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="blogInterest" class="mktoField mktoFieldDescriptor mktoFormCol" value="All Blog Posts" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Employees_Picklist__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="State" class="mktoField mktoFieldDescriptor mktoFormCol" value="State/Province" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Most_Recent_Medium__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="Website" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Most_Recent_Medium_Detail__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="www-pfpt" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Industry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Website" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="AnnualRevenue" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbasesid" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandBase_Data_Source" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Primary_Product_Interest__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="UTM_Post_ID__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="utmcampaign" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="utmterm" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="db_employee_count" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Unsubscribed" class="mktoField mktoFieldDescriptor mktoFormCol" value="0" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Submit</button></span></div>
</form>

<form data-mkto-id="19277" data-mkto-base="//app-abj.marketo.com" data-munchkin-id="309-RHV-619" data-submit-text="" data-redirect-link="" data-prefill="" data-event-label="" data-lang-code="us" data-validate-email="1"
  class="mk-form__form marketo-form-block__form mktoForm mktoHasWidth mktoLayoutLeft" data-asset-type="Blogs Subscribe" novalidate="novalidate"
  style="font-family: inherit; font-size: 16px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form>

<form data-mkto-id="19277" data-mkto-base="//app-abj.marketo.com" data-munchkin-id="309-RHV-619" data-submit-text="" data-redirect-link="" data-prefill="" data-event-label="" data-lang-code="us" data-validate-email="1"
  class="mk-form__form marketo-form-block__form mktoForm mktoHasWidth mktoLayoutLeft js-visible mkto-form-processed" data-asset-type="Blogs Subscribe" novalidate="novalidate"
  style="font-family: inherit; font-size: 16px; color: rgb(51, 51, 51); width: 1600px; visibility: hidden; position: absolute; top: -500px; left: -1000px;"></form>

Text Content

Skip to main content
English (Americas)
Search
Login
 * Products
 * Solutions
 * Resources

Proofpoint
Contact

Search

 * Products
 * Solutions
 * Partners
 * Resources
 * Company

Search
Login
English (Americas)
Products
Solutions
Partners
Resources
Company


MAXIMIZE SECURITY. OPTIMIZE VALUE.

Human-centric cybersecurity packages from Proofpoint.
See Packages

--------------------------------------------------------------------------------

Products
Protect People
Multi-layered, adaptive defenses for threat detection, impersonation, and
supplier risk.
Defend Data
Transform your information protection with a human-centric, omni-channel
approach.
Mitigate Human Risk
Unlock full user risk visibility and drive behavior change.
Premium Services
Leverage proactive expertise, operational continuity and deeper insights from
our skilled experts.


PROTECT PEOPLE

Multi-layered, adaptive defenses for threat detection, impersonation, and
supplier risk.
Learn More

Learn more about our products below:
Stop Human-Targeted Attacks
Prevent Impersonation


DEFEND DATA

Transform your information protection with a human-centric, omni-channel
approach.
Learn More

Learn more about our products below:
Prevent Misdirected Emails
Stop Data Loss
Contain Insider Threats


SOLUTIONS

See how we solve today's complex cyber threats and attacks.
Solutions by Industry
People-centric solutions for your organization.
Authenticate Your Email
Protect your email deliverability with DMARC.
Combat Email and Cloud Threats
Protect your people from email and cloud threats with an intelligent and
holistic approach.
Change User Behavior
Help your employees identify, resist and report attacks before the damage is
done.
Combat Data Loss and Insider Risk
Prevent data loss via negligent, compromised and malicious insiders.
Modernize Compliance and Archiving
Manage risk and data retention needs with a modern compliance and archiving
solution.
Protect Cloud Apps
Keep your people and their cloud apps secure by eliminating threats and data
loss.
Prevent Loss from Ransomware
Learn about this growing threat and stop attacks by securing ransomware's top
vector: email.
Secure Microsoft 365
Implement the best security and compliance solution for Microsoft 365.


SOLUTIONS BY INDUSTRY

People-centric solutions for your organization.
Federal Government
Cybersecurity for federal government agencies.
State and Local Government
Protecting the public sector, and the public from cyber threats.
Higher Education
A higher level of security for higher education.
Financial Services
Eliminate threats, build trust and foster growth for your organization.
Healthcare
Protect clinicians, patient data, and your intellectual property against
advanced threats.
Mobile Operators
Make your messaging environment a secure environment.
Internet Service Providers
Cloudmark email protection.
Small and Medium Businesses
Big-time security for small business.


PARTNERS

Deliver Proofpoint solutions to your customers.
Channel Partners

Archive Extraction Partners
Learn about Extraction Partners.
GSI and MSP Partners
Learn about our global consulting.
Technology and Alliance Partners
Learn about our relationships.
Social Media Protection Partners
Learn about the technology and....
Proofpoint Essentials Partner Programs
Small Business Solutions .
Become a Channel Partner


RESOURCES

Find reports, webinars, blogs, events, podcasts and more.
Resource Library

Blog
Keep up with the latest news and happenings.
Webinars
Browse our webinar library to learn about the latest threats, trends and issues
in cybersecurity.
Podcasts
Learn about the human side of cybersecurity.
New Perimeters Magazine
Get the latest cybersecurity insights in your hands.
Threat Glossary
Learn about the latest security threats.
Events
Connect with us at events to learn how to protect your people and data from
ever-evolving threats.
Customer Stories
Read how our customers solve their most pressing cybersecurity challenges.


COMPANY

Proofpoint protects organizations' greatest assets and biggest risks: their
people.
About Proofpoint

Why Proofpoint
Learn about our unique people-centric approach to protection.
Careers
Stand out and make a difference at one of the world's leading cybersecurity
companies.
News Center
Read the latest press releases, news stories and media highlights about
Proofpoint.
Privacy and Trust
Learn about how we handle data and make commitments to privacy and other
regulations.
Environmental, Social, and Governance
Learn how we apply our principles to positively impact our community.
Support
Access the full range of Proofpoint support services.
Search Proofpoint
Try searching for
Email Security Phishing DLP Email Fraud
Select Product Login
 * Support Log-in
 * Digital Risk Portal
 * Email Fraud Defense
 * ET Intelligence
 * Proofpoint Essentials
 * Sendmail Support Log-in

Select Language
 * English (Americas)
 * English (Europe, Middle East, Africa)
 * English (Asia-Pacific)
 * Español
 * Deutsch
 * Français
 * Italiano
 * Português
 * 日本語
 * 한국어

Blog
Threat Insight
From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering 


FROM SOCIAL ENGINEERING TO DMARC ABUSE: TA427’S ART OF INFORMATION GATHERING 

Share with your network!

April 16, 2024 Greg Lesnewich, Crista Giering, and the Proofpoint Threat
Research Team 


KEY TAKEAWAYS  

 * TA427 regularly engages in benign conversation starter campaigns to establish
   contact with targets for long-term exchanges of information on topics of
   strategic importance to the North Korean regime. 
 * In addition to using specially crafted lure content, TA427 heavily leverages
   think tank and non-governmental organization-related personas to legitimize
   its emails and increase the chances that targets will engage with the threat
   actor.  
 * To craftily pose as its chosen personas, TA427 uses a few tactics including
   DMARC abuse in concert with free email addresses, typosquatting, and private
   email account spoofing.  
 * TA427 has also incorporated web beacons for initial reconnaissance of its
   targets, establishing basic information like that the email account is
   active.  


OVERVIEW  

Proofpoint researchers track numerous state-sponsored and state-aligned threat
actors. TA427 (also known as Emerald Sleet, APT43, THALLIUM or Kimsuky), a
Democratic People’s Republic of Korea (DPRK or North Korea) aligned group
working in support of the Reconnaissance General Bureau, is particularly
prolific in email phishing campaigns targeting experts for insight into US and
the Republic of Korea (ROK or South Korea) foreign policy.  

Since 2023, TA427 has directly solicited foreign policy experts for their
opinions on nuclear disarmament, US-ROK policies, and sanction topics via benign
conversation starting emails. In recent months, Proofpoint researchers have
observed (Figure 1) a steady, and at times increasing, stream of this activity.
While our researchers have consistently observed TA427 rely on social
engineering tactics and regularly rotating its email infrastructure, in December
2023 the threat actor began to abuse lax Domain-based Message Authentication,
Reporting and Conformance (DMARC) policies to spoof various personas and, in
February 2024, began incorporating web beacons for target profiling. 

It is this initial engagement, and the tactics successfully leveraged by TA427,
which this blog is focused on. 



Figure 1. Volume of TA427 phishing campaigns observed between January 2023 and
March 2024. 


SOCIAL ENGINEERING 

TA427 is a savvy social engineering expert whose campaigns are likely in support
of North Korea’s strategic intelligence collection efforts on US and ROK foreign
policy initiatives. Based on the targets identified and the information sought,
it is believed that TA427’s goal is to augment North Korean intelligence and
inform its foreign policy negotiation tactics (example Figure 2). TA427 is known
to engage its targets for extended periods of time through a series of benign
conversations to build a rapport with targets that can occur over weeks to
months. They do so by constantly rotating which aliases are used to engage with
the targets on similar subject matter.  



Figure 2. Example of TA427 campaign focused on US policy during an election
year. 

Using timely, relevant lure content (as seen in Figure 3) customized for each
victim, and often spoofing individuals in the DPRK research space with whom the
victim is familiar to encourage engagement, targets are often requested to share
their thoughts on these topics via email or a formal research paper or article.
Malware or credential harvesting are never directly sent to the targets without
an exchange of multiple messages, and based on Proofpoint visibility, rarely
utilized by the threat actor. It is possible that TA427 can fulfill its
intelligence requirements by directly asking targets for their opinions or
analysis rather than from an infection. Additionally, insight gained from the
correspondence is likely used to improve targeting of the victim organization
and establish rapport for later questions and engagement.  



Figure 3. Timeline of real-world events based on international press reporting,
side-by-side with Proofpoint observed subject lures. 

Lure content often includes invitations to attend events about North Korean
policies regarding international affairs, questions regarding topics such as how
deterrence of other states has shaped North Korean policies, the prospect of a
nuclear weapons program being developed in the ROK, if nuclear weapons would be
used in a potential Chinese conflict with Taiwan, and requests to submit papers
on similar subjects. Such questions and cold outreaches (Figure 4 and 5) are
considered normal in the think tank and academic space, allowing TA427 to blend
in.  



Figures 4 and 5. Examples of TA427 cold outreaches to experts. 

TA427 also weaves conversations in multiple email threads between a target’s
personal and corporate email addresses, likely to avoid security controls on
corporate email gateways. This establishes some amount of trust but allows for
the rare instances of malware, such as ReconShark, to be deployed to a corporate
device if the victim is using their corporate computer to check personal email. 


TA427’S MOST IMPERSONATED 

TA427’s benign campaign activity tends to impersonate individuals that work in
the following verticals: thinks tanks and non-governmental organizations (NGOs),
media, academia, and government. TA427 usually masquerades as members of think
tanks and NGOs to engage targets (Figure 6). This is likely due to better odds
of successfully convincing targets of the legitimacy of the threat actor’s
requests for information or engagement by using such personalities. Over the
years, Proofpoint researchers have observed TA427 pose as many well-known thinks
tanks and NGOs, including the Stimson Center, the Atlantic Council, the Wilson
Center, the Ronald Reagan Presidential Foundation and Institute, and the Maureen
and Mike Mansfield Foundation, among others.  



Figure 6. Percent of campaigns leveraging personas from four main verticals
between January 2023 and March 2024. 

Further, TA427 tends to rely on one of three methods of impersonation for this
activity (Figure 7), specifically DMARC abuse, which will be delved into further
in the next section, typosquatting (Figure 8), and private email account
spoofing using free email services.  



Figure 7. Percent of campaigns using DMARC abuse, private email account
spoofing, and typosquatting to masquerade as various personas from January 2023
through March 2024. 



Figure 8. Example of TA427 campaign using typosquatting with an actor-controlled
email sender of “nknevvs” instead of “nknews” to masquerade as the popular NK
News publication. 


DMARC SPOOFING 

DMARC is an open email authentication protocol that provides domain-level
protection of the email channel. DMARC authentication uses previously
established standards, SPF and DKIM, using DNS TXT records and key exchanges to
validate the senders.  

Since December 2023, many of the entities that TA427 has spoofed either did not
enable or enforce DMARC policies. A permissive DMARC policy such as “v=DMARC1;
p=none; fo=1;” allows for spoofed emails to bypass security checks. This also
ensures delivery to the targeted user even if security checks fail, and TA427
will modify the header to display the sender being from the spoofed
organization. TA427 then uses free email addresses spoofing the same persona in
the reply-to field to convince the target that they are engaging with legitimate
personnel. 

Proofpoint provides a free DMARC record checking tool that can be used to check
the domain record of an organization and validate that it does not have a
permissive policy. 


WEB BEACON USAGE 

The use of web beacons is a new tactic for TA427, which Proofpoint researchers
first observed in February 2024. Web beacons, which are commonly referred to as
tracking pixels, tracking beacons, and web bugs and are known to be leveraged by
other advanced persistent threat actors, embed a hyperlinked non-visible object
within the body of an email that, when enabled, attempt to retrieve a benign
image file from an actor-controlled server. The web beacons are likely intended
as initial reconnaissance to validate targeted emails are active and to gain
fundamental information about the recipients’ network environments, including
externally visible IP addresses, User-Agent of the host, and time the user
opened the email.  



Figure 9. Example of TA427 campaign using a web beacon. 


CONCLUSION  

TA427 is one of the most active state-aligned threat actors currently tracked by
Proofpoint. While the campaigns noted in this blog are not fleecing targets out
of millions of dollars, this activity goes after something that is infinitely
more difficult to quantify: information and influence. For years, this threat
actor has been impersonating key DPRK subject matter experts in academia,
journalism, and independent research to target other experts and gain footholds
at their respective organizations for long-term strategic intelligence
gathering. With a clear degree of success, TA427 shows no indication of slowing
down or losing its agility in adjusting its tactics and standing up new
infrastructure and personas with expediency. 


INDICATORS OF COMPROMISE (IOCS)    

Indicator

Type

Track 1.5 dialogue on CBRNE threat reduction in the Indo-Pacific  

 

Invitation: August DPRK meeting 

 

Draft Taiwan Issue 

 

emergence of Indigenous Nuclear Weapons Debate 

  

Request for Meeting(Korean Embassy) 

 

Invitation: 20/9 Conference - An Allied Approach to North Korea 

 

Invitation: 30/9 Conference - An Allied Approach to North Korea 

 

Request for Comments 

 

Invitation: 25/10 Conference - An Allied Approach to North Korea 

 

Invitation to CTR Workshop November 9  

 

DTRA Track 1.5 dialogue on Indo-Pacific CBRNE threat reduction  

 

Invitation to review 

 

Invitation to Korea Global Forum 2024 (Seoul, February 20-21) 

 

Event with the Korea Society "Rumbles of Thunder and Endangered Peaceon the
Korean Peninsula"  

 

[Invitation] US Policy Toward North Korea - Pocantico Center February6-8  

  

RISG 2024 Winter Meeting Invitation  

 

Invitation to speak at the East Asia Strategy Forum  

 

Discussion about DPRK sanctions  

 

Invitation: 3/5 Conference - An Allied Approach to North Korea  

  

US-ROK dialogue  

 

Seeking Comments   

 

Essay Series: Peaceful Co-existence with North Korea  

 

[Invitation] US Policy Toward North Korea - Pocantico Center March 12-14 

 

Invitation as a Discussant for a US-ROK Research Project Seminar 

 

Lunch Invitation to meet with Senior Deputy Minister for Foreign Affiars 

 

2023 & 2024 Email Subjects  

stimson[.]shop 

stimsonn[.]org 
nknevvs[.]org 

wilsoncenters[.]org 
wilsoncentre[.]org 

2023 & 2024 Spoofed Domains 

Previous Blog Post
Next Blog Post


SUBSCRIBE TO THE PROOFPOINT BLOG

*
Business Email:




















Submit
*
Business Email:




















Submit
Products
 * Protect People
 * Defend Data
 * Mitigate Human Risk
 * Premium Services

Get Support
 * Product Support Login
 * Support Services
 * IP Address Blocked?

Connect with Us
 * +1-408-517-4710
 * Attend an Event
 * Contact Us

More
 * About Proofpoint
 * Why Proofpoint
 * Careers
 * Leadership Team
 * News Center
 * Privacy and Trust

© 2024. All rights reserved.
Terms and conditions Privacy Policy Sitemap
 * 
 * 
 * 
 *