North Korean-backed threat actors have been suspected of unleashing weekly cyberattacks on a wide array of targets throughout the early months of 2021 and are continuing to do so. The group, known as TA406 / “Kimusky” / “Thallium”, is a notorious financially motivated hacking group with heavy involvement in cyber espionage, digital crimes, and sextortion. The threat group’s primary attack vector included frequent credential phishing campaigns against organizations in the Korean peninsula, as well as journalists and academics. TA406 also has close relations with the North Korean military, which are known for attacks against western national security organizations. The group’s hacking arsenal includes “Konni”, which is a family of malicious remote access trojans (RATs), phishing scripts, credential harvesting modules, and more. Campaigns spun up from this group so far this year includes a March phishing operation where threat actors executed a very common social engineering attack on users in an attempt to get them to download malicious files to their computer systems. Following this operation, in June the group altered its phishing campaign tactics to include the malicious ‘FatBoy’ file, which would create a connection to the threat actors command-and-control (C2) server to pull down additional malware payloads to the victims machine. CTAPT will continue to monitor the movements of these threat actors and provide updates accordingly.