MONTHLY THREAT ACTOR GROUP INTELLIGENCE REPORT, MARCH 2022 (KOR)
2022-05-02 • NSHC •
https://redalert.nshc.net/2022/05/02/monthly-threat-actor-group-intelligence-report-march-2022-kor/
NSHC's March 2022 monthly actor report recorded five SectorA groups active in Korea, Macau, Hong Kong, Japan, France, Singapore, the United States, and the United Kingdom. The Korea-focused SectorA02 activity impersonated a South Korean central administrative agency official, used phishing sites to collect information, and paired the operation with HWP lure documents. Other SectorA activity used spear-phishing emails against Macau hospitality businesses, government-themed phishing emails, CHM files, and product-introduction Word documents. NSHC assessed ongoing SectorA activity as focused on collecting high-value information related to Korean political, diplomatic, and government activity while also pursuing financially motivated operations worldwide. The report is relevant because it places multiple lure formats and target geographies into one monthly view of sustained SectorA collection and financially motivated tradecraft.