cta-2023-0606.pdf (4 MB)

Recorded Future’s Insikt Group identified a TAG-71 cluster from September 2022 to March 2023 that spoofed financial institutions and venture capital firms in Japan, Vietnam, and the United States. The activity closely overlaps public reporting on North Korean APT38, also known as Bluenoroff, Stardust Chollima, and BeagleBoyz, and included 74 domains resolving to five IP addresses plus six malicious files. Observed delivery methods included ZIP archives with password-protected PDFs, DOCX template injection to external infrastructure, and double-extension LNK files that launched pcalua.exe or mshta.exe. Newly observed infrastructure included 172.93.181[.]221, 104.168.143[.]222, and 104.168.149[.]145, with reused IPs 155.138.159[.]45 and 104.255.172[.]56 hosting document-sharing and financial-brand lookalike domains. The targeting aligns with North Korean financially motivated operations against financial and investment entities, where compromise could expose sensitive firm or customer information.