PAEKTUSAN
2024-06-12 • Google • Insights on Cyber Threats Targeting Users and Ent…
PAEKTUSAN is Google’s designation for a North Korean government-backed threat actor that has targeted aerospace and defense personnel through fraudulent recruitment. Google described two campaigns against professionals in Brazil and other regions: one used an account impersonating a human-resources director at a Brazilian aerospace company to phish employees at another aerospace firm, while another posed as a recruiter from a major United States aerospace company. The actor contacted prospective victims through email, social media, and likely messaging applications with false job opportunities. Malicious links led to a document containing a job-posting lure that installed AGAMEMNON, a C++ downloader. Google assessed that these campaigns were consistent with Operation Dream Job, a broader North Korean pattern of weaponizing attractive employment offers to compromise people with access to strategically valuable organizations and information.
-
16
Related Actors
-
147
Related Reports