A state-sponsored North Korean threat actor tracked as TA406 was recently observed deploying custom info-stealing malware in espionage campaigns. The actor is attributed as one of several groups known as Kimsuky (aka Thallium) Researchers at Proofpoint tracked TA406, sampled their tools, and discovered the services they abuse and the phishing lures they employ. TA406 is engaging in malware distribution, phishing, intelligence collection, and cryptocurrency theft, resulting in a wide range of criminal activities.”]