A North Korean state-sponsored threat actor known as ARCHIPELAGO has been linked to cyberattacks targeting think tanks in South Korea and the U.S. Researchers in South Korea and Google’s Threat Analysis Group (TAG) has tracked the ARCHIPELAGO for over a decade and determined its priorities to line up with the Reconnaissance General Bureau (RGB), North Korea’s foreign intelligence agency. ARCHIPELAGO primarily relies on the use of phishing emails that contain malicious links. These links redirect to recreated fake login pages for credential harvesting. ARCHIPELAGO also takes its time with victims, typically spending weeks building trust with the target before finally sending the malicious link to them. By also applying the “browser-in-the-browser” technique, which renders a fake window within an actual browser window, they can further convince the victim of the login page’s authenticity. Although email is the primary form of malware delivery, ARCHIPELAGO has also experimented with ISO files, Chrome extensions, and encoding commands into drive names, showing a slow but steady increase in sophistication with their attack techniques. ARCHIPELAGO has posed as a variety of actors, including journalists and government agencies in order to trick its victims. CTIX analysts will continue to monitor ARCHIPELAGO and its attacks across the globe.