A U.S. district court issued an order enabling Microsoft to take over 50 domains used by a North Korea-based cybercrime gang to conduct spear phishing campaigns.
Microsoft’s Digital Crimes Unit and the Microsoft Threat Intelligence Center took down the domains controlled by a group it named Thallium after researching the malicious actors activity and filing a report with the U.S. District Court for the Eastern District of Virginia, said Tom Burt, Microsoft’s corporate vice president, customer Security and trust.
The court documents were unsealed on December 27 and detailed Microsoft’s work deciphering how Thallium, which is believed to be North Korean, operated its campaigns. The group, according to Burt’s report, did extensive online research to develop the information needed to properly socially engineer the spear phishing emails. Targets included government employees, think tanks, university staff members, members of organizations focused on world peace and human rights, and individuals that work on nuclear proliferation issues. Most of the targets were based in the U.S., as well as Japan and South Korea.
A phishing email would generally contain a message requesting the individual click on an embedded link in order to correct an issue. Once the link is clicked the victim is taken to a fraudulent site and asked to supply their login credentials at which point Thallium has the ability to take over the account.
“Upon successful compromise of a victim account, Thallium can review emails, contact lists, calendar appointments and anything else of interest in the compromised account. Thallium often also creates a new mail forwarding rule in the victim’s account settings. This mail forwarding rule will forward all new emails received by the victim to Thallium-controlled accounts. By using forwarding rules, Thallium can continue to see email received by the victim, even after the victim’s account password is updated,” Burt said.
Thallium also used this access to plant the persistent, information-stealing malware BabyShark or KimJongRAT.
