Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
financialThreat Actor
Active Threat
TA406
80
IOCs Tracked
4
Intel Reports
Associated IOCs50 total
IP13
45.86.208.162
2026-10-18Medium211.211.6.181
2026-10-18High38.75.137.972026-10-18High70.32.3.152026-10-18High23.237.102.130
2026-10-18High103.214.44.138
2026-10-18High185.135.76.89
2026-10-18High188.43.33.252
2026-10-18High66.118.255.352026-10-18High91.239.130.102
2026-10-18High167.88.61.1172026-10-18High50.7.159.342026-10-18High37.120.154.982026-10-18HighDomain2
opensanctions.org2026-10-18High
fincen.gov2026-10-18High
URL35
https://www.38north.org/2018/08/rfrank080818/2026-10-18High
https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-2026-10-18High
https://asiasociety.org/policy-institute/russia-north-korea-military-cooperation-response-chinas-tactical-ambiguity2026-10-18High
https://www.nknews.org/2026/04/russia-issued-over-36k-visas-to-north-koreans-in-2025-almost-all-for-education/2026-10-18High
https://home.treasury.gov/news/press-releases/jy27902026-10-18High
https://s2w.inc/en/resource/detail/10902026-10-18High
https://www.tradingview.com/news/cointelegraph:5ca7f0869094b:0-onyx-protocol-exploited-a-second-time-for-3-2026-10-18High
https://main.un.org/securitycouncil/en/s/res/2371-%282017%292026-10-18High
https://www.silentpush.com/2026-10-18High
https://gfsis.org/en/the-strategic-partnership-agreement-between-2026-10-18High
https://www.opensanctions.org/entities/kprusi-3d6e2f6255ea677c2f68d1508bd161d2a3645db8/2026-10-18High
https://understandingwar.org/research/china-taiwan/north-koreas-constitutional-amendments-2026-10-18High
https://cointelegraph.com/news/munchables-hacker-returns-ether-without-ransom2026-10-18High
https://www.38north.org/2025/06/north-korea-russia-people-to-people-2026-10-18High
https://main.un.org/securitycouncil/en/s/res/2375-%282017%292026-10-18High
https://main.un.org/securitycouncil/en/s/res/2397-%282017%292026-10-18High
https://www.jstor.org/stable/263959762026-10-18High
https://www.chosun.com/english/north-korea-en/2024/01/16/NZ2TGZIDRJDG3MYB6Z5ZUXFDYM/2026-10-18High
https://home.treasury.gov/news/press-releases/jy14982026-10-18High
https://kudelskisecurity.com/research/dprk-fake-it-workers-inside-their-evolving-network-infrastructure2026-10-18High
https://www.politico.eu/article/north-korea-russia-mandatory-school-mgimo/2026-10-18High
https://www.csis.org/analysis/hidden-enablers-third-countries-north-koreas-cyber-playbook2026-10-18High
https://ieeexplore.ieee.org/document/8756954/2026-10-18High
https://kudelskisecurity.com/research/how-dprks-contagious-interview-campaign-targets-developers2026-10-18High
https://home.treasury.gov/news/press-releases/sb03022026-10-18High
https://www.wsj.com/articles/how-north-koreas-2026-10-18High
https://research.kudelskisecurity.com/2015/11/05/sphinx-moth-expanding-our-knowledge-of-the-wild-neutron-morpho-apt/2026-10-18High
https://home.treasury.gov/news/press-releases/sb02052026-10-18High
https://www.38north.org/2026/05/quick-take-the-leader-gets-a-strong-constitution/2026-10-18High
https://www.opensanctions.org/entities/NK-37t8mDJBBsxKzZxfhW8Qo2/2026-10-18High
https://msmt.info/Publications/detail/MSMT%20Report/42212026-10-18High
https://www.nkleadershipwatch.org/2026/06/05/internal-security-and-ic-changes/2026-10-18High
https://www.fincen.gov/news/news-releases/fincen-2026-10-18High
https://www.hrnk.org/documentations/the-reconnaissance-2026-10-18High
https://www.kinu.or.kr/eng/module/report/view.do?idx=125351&nav_code=eng16748060002026-10-18High
Related Reports4 total
Kudelski Security Research
ORKL Threat Library
Beyond Lazarus: How North Korea Organizes Its Cyber Operations
Sekoia BlogAug 31, 2026
Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell Malware
Cyber PressSep 24, 2026
To Russia With Love: Assessing a KONNI-Backdoored Suspected Russian Consular Software Installer
DCSO CyTec BlogFeb 21, 2024
Threat Profile
Motivationfinancial
Last seenOct 2026
IOCs tracked80