TA406 Hackers Attacking to Attack Government Entities to Steal Login Credentials

A Democratic People’s Republic of Korea (DPRK)-linked threat actor tracked as TA406 has intensified cyber espionage efforts against Ukrainian government entities since February 2025, deploying sophisticated phishing campaigns aimed at stealing login credentials and deploying reconnaissance malware. For example, TA406’s PowerShell scripts generate a state.bat file configured to execute on system startup, ensuring prolonged access to compromised devices. Proofpoint researchers identified TA406’s use of spoofed think tank personas and compromised email services to deliver malicious links and attachments, aligning with historical DPRK strategies to exploit geopolitical tensions for intelligence collection. Clicking the CHM file triggers embedded PowerShell scripts designed to harvest system data, including network configurations, running processes, and antivirus software details. The ZIP contains an LNK file (Why Zelenskyy fired Zaluzhnyi.Ink) that executes Base64-encoded PowerShell (Figure 2), deploying a JavaScript Encoded (JSE) file for persistence. A February 2025 campaign used emails titled “Meet Valerii Zaluzhnyi, Ukraine’s former army chief who could challenge Volodymyr Zelenskyy in the presidential election” to lure targets into downloading a RAR archive. Proofpoint emphasizes that TA406’s campaigns reflect DPRK’s strategic priority to monitor Ukraine’s political stability and military readiness. The group, which overlaps with activity publicly attributed to Opal Sleet and Konni, has shifted focus to gather strategic intelligence on Ukraine’s political and military trajectory amid the ongoing Russian invasion. TA406’s campaigns impersonate fictitious organizations such as the “Royal Institute of Strategic Studies,” with emails purportedly sent by a senior fellow, Dr. The JSE file establishes a scheduled task (Windows Themes Update) to contact TA406’s C2 server (hxxp://wersdfxcv.mygamesonline[.]org) every minute. The archive’s CHM file, Analytical Report.chm, contains HTML pages with embedded PowerShell code. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Once decrypted, the archive deploys a CHM (Compiled HTML Help) file disguised as a political analysis report. Proofpoint analysts noted that TA406 employs multi-stage PowerShell payloads to exfiltrate this data to actor-controlled domains, which are subsequently used to refine further attacks.

This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 15 May 2025 11:15:04 +0000


Cyber News related to TA406 Hackers Attacking to Attack Government Entities to Steal Login Credentials

TA406 Hackers Attacking to Attack Government Entities to Steal Login Credentials - A Democratic People’s Republic of Korea (DPRK)-linked threat actor tracked as TA406 has intensified cyber espionage efforts against Ukrainian government entities since February 2025, deploying sophisticated phishing campaigns aimed at stealing ...
2 weeks ago Cybersecuritynews.com
North Korean hackers target Ukrainian government in new espionage campaign | The Record from Recorded Future News - North Korea, which started deploying troops to assist Russian forces in Ukraine in late 2024, is likely using this intelligence to assess risks to its own forces on the ground and to gauge whether Moscow will require further military support, ...
2 weeks ago Therecord.media
Lawmakers: Ban TikTok to Stop Election Misinformation! Same Lawmakers: Restrict How Government Addresses Election Misinformation! - In a case being heard Monday at the Supreme Court, 45 Washington lawmakers have argued that government communications with social media sites about possible election interference misinformation are illegal. Just this week the vast majority of those ...
1 year ago Eff.org
The Unlikely Romance of Hackers and Government Suitors - The annual Hack the Capitol event brings together a diverse group of scientists, hackers, and policymakers to educate congressional staffers, scholars, and the press about the most critical cybersecurity challenges facing our nation. Hack the Capitol ...
1 year ago Darkreading.com
Chinese Hackers Target Iranian Government Entities in Months-long Attack - A months-long attack by Chinese hackers has been targeting Iranian government entities, according to a report by CSO Online. The hackers, named IAMPrime, have been targeting government institutions in Iran since at least July of last year. The ...
2 years ago Csoonline.com
Cyberattack on North Carolina county allowed hackers to access data - A cyberattack on a North Carolina county has forced officials to call in the state's national guard for assistance. In a message to residents on Tuesday, Bladen County said it became the victims of a cyberattack last week. The county - tucked in the ...
1 year ago Therecord.media
Cybersecurity Crisis Looms: FBI Chief Unveils Chinese Hackers' Plan to Target US Infrastructure - As the head of the FBI pointed out Wednesday, Beijing was positioning itself to disrupt the daily lives of Americans if there was ever a war between the United States and China if it were to plant malware to damage civilian infrastructure. U.S. ...
1 year ago Cysecurity.news Volt Typhoon
Chinese Earth Krahang hackers breach 70 orgs in 23 countries - A sophisticated hacking campaign attributed to a Chinese Advanced Persistent Threat group known as 'Earth Krahang' has breached 70 organizations and targeted at least 116 across 45 countries. According to Trend Micro researchers monitoring the ...
1 year ago Bleepingcomputer.com CVE-2023-32315 CVE-2022-21587 Earth Lusca GALLIUM
UK sets out new cyber reporting requirements for critical infrastructure | The Record from Recorded Future News - The original law introduced duties for organizations in critical sectors to report cyber incidents to their regulators, but the thresholds for reportable incidents were based on the “interruption to the continuity of the essential or digital ...
1 month ago Therecord.media
Credentials are Still King: Leaked Credentials, Data Breaches and Dark Web Markets - Infostealers infect computers, steal all of the credentials saved in the browser along with active session cookies and other data, then export it back to command and control infrastructure before, in some cases, self-terminating. This article will ...
1 year ago Bleepingcomputer.com
Fortifying cyber defenses: A proactive approach to ransomware resilience - Ransomware has become a pervasive threat, compromising the security and functionality of vital systems across the United States. While governmental pledges and public declarations of intent to fight cybercrime are foundational, they often lack the ...
1 year ago Helpnetsecurity.com
How Hackers Interrupted GTA 5 Online Gameplay on PC - Recently, a cyber-attack on Grand Theft Auto 5 Online on PC caused an interruption to thousands of players’ gameplays. The game was completely taken offline and players couldn’t even access the main gameplay menu. The attack caused an uproar ...
2 years ago Hackread.com
What Should We Expect for State and Local Government IT Priorities in 2024? - As we wrap up 2023, it is a great time to reflect on the current state of technology in state and local governments and look ahead to the priorities for the coming year. Maintaining the security of networks and the data they carry continues to be the ...
1 year ago Feedpress.me
North Korean Hackers Utilizing Credential Stuffing to Launch Cyberattacks - In an alarming new report, researchers found that North Korean-linked hackers have been using stolen passwords during cyberattacks to gain access to various government, military and financial networks. According to security experts, the creative ...
2 years ago Thehackernews.com
Understanding Backdoor Diplomacy Attack on Iranian Government Entities - In today’s digital world, cyberattacks are becoming increasingly prevalent, particularly against governments and public or private entities. Recently, a new targeted attack against Iranian government entities has been detected. Dubbed “Backdoor ...
2 years ago Heimdalsecurity.com Cozy Bear
Simeio Returns to Compete in 2024 'ASTORS' Awards with Simeio OI - Home IT Security Communications Simeio Returns to Compete in 2024 'ASTORS' Awards with Simeio OI. A global managed services provider offering Identity and Access Management solutions, Simeio secures over 160 million identities globally for large ...
1 year ago Americansecuritytoday.com
Attack Vector vs Attack Surface: The Subtle Difference - Cybersecurity discussions about "Attack vectors" and "Attack surfaces" sometimes use these two terms interchangeably. This article guides you through the distinctions between attack vectors and attack surfaces to help you better understand the two ...
2 years ago Trendmicro.com
NASCIO, PTI on What's Coming in 2024 for State and Local IT - Every January, NASCIO and PTI release their forecasts for the coming year based on what government leaders are saying. Adobe Stock/OleCNX. When Doug Robinson speaks, the government technology community listens. He has been the exceptional executive ...
1 year ago Securityboulevard.com
Google: Hackers exploited Zimbra zero-day in attacks on govt orgs - Google's Threat Analysis Group has discovered that threat actors exploited a zero-day vulnerability in Zimbra Collaboration email server to steal sensitive data from government systems in multiple countries. Hackers leveraged a medium-severity ...
1 year ago Bleepingcomputer.com CVE-2023-37580 CVE-2022-24682 CVE-2023-5631
Russian military hackers target NATO fast reaction corps - Russian APT28 military hackers used Microsoft Outlook zero-day exploits to target multiple European NATO member countries, including a NATO Rapid Deployable Corps. Researchers from Palo Alto Networks' Unit 42 have observed them exploiting the ...
1 year ago Bleepingcomputer.com CVE-2023-23397 Fancy Bear APT28
Russian hackers exploiting Outlook bug to hijack Exchange accounts - Microsoft's Threat Intelligence team issued a warning earlier today about the Russian state-sponsored actor APT28 actively exploiting the CVE-2023-23397 Outlook flaw to hijack Microsoft Exchange accounts and steal sensitive information. The targeted ...
1 year ago Bleepingcomputer.com CVE-2023-23397 CVE-2023-38831 CVE-2021-40444 APT28
North Korean Hackers Use Fake Job Offers & Salary Bumps as Lure for Crypto Theft - Recent investigations have uncovered a massive operation carried out by North Korean hackers looking to steal cryptocurrency through fake job offers and salary bumps. According to recent reports, hackers have been able to trace the malicious ...
2 years ago Therecord.media
US govt sanctions North Korea's Kimsuky hacking group - The Treasury Department's Office of Foreign Assets Control has sanctioned the North Korean-backed Kimsuky hacking group for stealing intelligence in support of the country's strategic goals. OFAC has also sanctioned eight North Korean agents for ...
1 year ago Bleepingcomputer.com Andariel Kimsuky
What a Digital ID Means to How Australians Interact With Businesses Online - Australia is about to get a national online ID system - the Digital ID - which promises to improve the security and privacy of data online. In just a few months, Australians will have access to a new form of ID, which aims to make identification ...
1 year ago Techrepublic.com
CyberCrime & Doing Time: Classic Baggie: Part 2 - Q. I want to focus on your relationship with Classic Baggie. Q. You said you were working as an apprentice at that time. Q. Ms. Busch, could we pull up 402(c-1), which again is a larger version of that image. Q. Ms. Busch, can you please pull up ...
1 year ago Garwarner.blogspot.com