Thallium

Thallium, also known as Kimsuky, Velvet Chollima, and APT43, is a North Korean state-sponsored threat actor or hacking group that has been active since 2012. Tracked by the Cybereason Nocturnus Team and other security researchers, this cyber espionage group is believed to operate on behalf of the North Korean regime. It has been involved in various cyberespionage and cybercrime operations, targeting organizations such as news media, academic entities, and think tanks globally. The group's primary tactics include social engineering and it is linked to North Korea’s main military intelligence organization, the General Reconnaissance Bureau. In June 2023, U.S. and South Korean intelligence agencies issued warnings about ongoing attacks from Kimsuky, alerting targeted sectors to the potential risk. These alerts came after the FBI and National Security Agency released a joint cybersecurity advisory detailing how Thallium was exploiting vulnerabilities for its benefit. The group has been known to launch attacks against foreign governments, academic institutions, and major media corporations, furthering North Korea's national intelligence objectives. Despite public outing, the group continues to grow and pose significant threats. It is considered among the top threat actors alongside China state-sponsored group APT41 (also known as Double Dragon and Wicked Panda) and the North Korea-sponsored Lazarus Group. The Department of Health and Human Services' Health Sector Cybersecurity Coordination Center identified Thallium as a serious threat in a brief issued in 2024, emphasizing the persistent and evolving nature of these state-sponsored cyber threats.