Thallium

Thallium, also known as Kimsuky, APT43, Velvet Chollima, and Black Banshee, is a significant threat actor that has been active since at least 2012. This group, believed to be operating on behalf of the North Korean regime, conducts intelligence collection and uses cybercrime to fund espionage activities. The group's operations have evolved over time, with activities being traced back to at least 2018 under various aliases. Thallium has employed sophisticated methods in its operations, including leveraging artificial intelligence tools like ChatGPT to draft more convincing content for phishing emails. The Cybereason Nocturnus Team and other security researchers have been actively tracking the activities of this group. Thallium has targeted a wide range of entities, including news media organizations, academic institutions, think tanks, foreign governments, and major media corporations. In June 2023, U.S. and South Korean intelligence agencies issued warnings about the group's escalating cyberespionage attacks. Moreover, Thallium has been identified as one of the top threat actors by the Department of Health and Human Services' Health Sector Cybersecurity Coordination Center, alongside other notable groups like China's state-sponsored APT41 and North Korea's Lazarus Group. Despite public exposure and international advisories, Thallium continues to grow and evolve its tactics. The group is notorious for its focus on social engineering and is linked to North Korea’s main military intelligence organization, the General Reconnaissance Bureau. With the continuous evolution of cyber threats, it is crucial for entities worldwide to remain vigilant and enhance their cybersecurity measures to counteract these advanced persistent threats.