A North Korean hacking group spent the first half of 2021 running phishing attacks at near-weekly frequency, then made a notable shift: instead of just stealing credentials, it started delivering information-gathering malware by email, Proofpoint researchers found.
The group, tracked as TA406 and publicly known as Kimsuky or Thallium, has run espionage operations since at least 2012 and financial crimes since 2018. The 2021 campaign data shows an actor willing to invest more effort when the target is valuable enough—and the targets are people with access to sensitive sources, policy drafts, and diplomatic thinking.
The short version
- Tracked by Proofpoint as TA406; also publicly identified as Kimsuky, Thallium; linked to the Konni remote access trojan family.
- Conducted near-weekly attacks throughout the first half of 2021.
- Primary targets: foreign policy experts, NGOs focused on the Korean peninsula, journalists and academics.
- Activity spans espionage, digital crime and sextortion.
- First documented malware campaigns appeared in March and June 2021, impersonating recognized experts and targeting North American entities.
How the playbook evolved
TA406's bread and butter has long been credential phishing—luring targets to fake login pages and harvesting passwords. That approach works when people reuse passwords or have gaps in multi-factor authentication. But credential theft limits what an attacker can reach after a successful compromise.
The March and June 2021 campaigns marked a deliberate step up. Both impersonated recognized North Korea and foreign policy specialists, sending messages to North American targets with attachments designed to drop information-gathering malware. Researchers also noted overlap with the Konni RAT family, linking current activity to a known toolkit defenders may already flag in their environments.
The pattern matters: the actor is no longer simply collecting logins. It is investing in persistent access that can harvest keystrokes, exfiltrate files, and maintain a foothold beyond a single password reset.
Why this matters
Escalating incident costs.** Credential theft typically triggers a password reset and a review of access logs. A malware compromise means forensic investigation, potential reimaging of devices, and a wider assumption of exposure—especially for accounts that touched the malicious payload.
Trust as the attack surface.** The impersonation of real, recognizable experts exploits a natural tendency: if a message looks like it comes from someone you know and respect, you are less likely to treat it as hostile. That social engineering hook is harder to train away than a generic "verify this bank login" lure.
Sustained tempo.** Near-weekly activity is not a one-off campaign. It means defenders cannot treat a single takedown as a closed case. The threat is persistent, which raises the bar for controls that last beyond any given incident.
Who should care
| Profile | Risk level | Why they are a target |
|---|---|---|
| Think tanks and policy NGOs | High | Work on North Korea and sanctions makes them directly relevant to Pyongyang's interests; a single inbox can expose research and contacts |
| Journalists covering Korea or diplomacy | High | Source lists, unpublished drafts, and unpublished reporting are intelligence assets; contacts may be mapped through email threads |
| Academics in Korean studies or international relations | Moderate | Ongoing research and conference networks create lures that feel normal; less likely to have dedicated security support |
| NGOs broadly | Moderate | Small IT teams and shared credentials make credential theft cheap to execute; malware adds asymmetric cost to incidents |
What to watch next
TA406 is likely to keep credential phishing at high frequency and to continue deploying malware when campaigns warrant the extra effort. The named-impersonation tactic is effective and repeatable—expect it around newsworthy events like sanctions votes, diplomatic talks, or any moment when a message from a Korea expert feels expected.
For defenders, the practical steps are unglamorous but necessary: phishing-resistant MFA, strict attachment and macro policies, segmentation for accounts handling sensitive sources, and a practiced habit of verifying unusual requests out of band. The actor is patient. Your controls need to match.
Key takeaways
- TA406 (Kimsuky/Thallium) ran near-weekly phishing in early 2021 and added malware campaigns in March and June, Proofpoint documented.
- Policy NGOs, academics and journalists face the highest exposure because compromised inboxes can expose sources, contacts and unpublished work.
- Expert impersonation is the social engineering hook; verify unexpected requests through a channel you already trust.
- Treat any account that opened a TA406 lure as potentially compromised—reset credentials, re-confirm MFA, and preserve the message for analysis.
Frequently asked questions
Who is TA406?
TA406 is Proofpoint's tracking name for a North Korean state-linked group also called Kimsuky or Thallium, active in espionage since at least 2012 and financial crime since 2018.
Who did TA406 target in 2021?
Foreign policy experts, NGOs focused on the Korean peninsula, journalists and academics, according to Proofpoint's research.
What changed about TA406's activity in 2021?
Proofpoint documented two campaigns, in March and June, that delivered information-gathering malware rather than solely harvesting credentials—a notable escalation in capability.
How does TA406 trick its targets?
By posing as recognized North Korea and foreign policy specialists in email, using familiar names and plausible contexts to lower the target's guard before the malicious payload is delivered.
What should a small NGO or newsroom do if it suspects a TA406 lure?
Do not open attachments or click links in the suspicious message. Verify the request with the claimed sender through a pre-existing trusted channel. Report the message to your IT team or security provider, reset credentials on any account that interacted with it, and re-confirm MFA enrollment.