The adversary, which security researchers also refer to as Kimsuky, Thallium, and Konni, has been targeting organizations in sectors such as education, government, media, and research, as well as other industries.
According to Proofpoint, TA406 aligns the most with Kimsuky activity, which the security firm tracks as three different threat actors, namely TA406, TA408 and TA427.
“Our analysts have tracked TA406 campaigns targeting customers since 2018, but the threat actor’s campaigns remained low in volume until the beginning of January 2021,” the company said.
