2021 Fall/Winter Threat Update

Proofpoint details TA406 — a DPRK-aligned threat actor — which in 2021 executed near-weekly credential-phishing campaigns against researchers, academics, NGOs, media and government targets, sometimes delivering malware (e.g., FatBoy downloader, YoreKey keylogger) and conducting financially motivated schemes (sextortion, cryptocurrency-themed lures); the report includes TTPs (PHPMailer/Star tools, PHProxy, Basic HTTP auth, PDF decoys), campaign timing/targeting analysis, malware behavior, IoCs (domains, hosts, hashes, IPs) and detection rules.