CyberWire Daily

The art of information gathering. [Research Saturday]

Apr 20, 2024

Guest Greg Lesnewich, senior threat researcher at Proofpoint, discusses TA427's use of social engineering and DMARC abuse for information gathering. The group targets policy experts through phishing emails, highlighting the importance of security awareness. They explore the challenges of implementing DMARC policies to prevent spoofing attacks and the role of email in low-level espionage.

31:48

Creator website

Episode guests

Greg Lesnewich

AI Summary

AI Chapters

Episode notes

Podcast summary created with Snipd AI

Quick takeaways

TA427 uses social engineering and DMARC abuse to gather information from policy experts.

TA427 poses as North Korean watchers to solicit opinions on policies and events.

Deep dives

TA427's Tactics and Targets

TA427, known for its phishing emails, targets policy experts in government, NGOs, and think tanks, mainly focusing on those who impact North Korean policies. The group poses as well-known North Korean watchers to gather insights for North Korea. By spoofing prominent individuals, they engage in a collegial exchange, asking for opinions on policies and current events to stay informed and potentially influence policies in Northeast Asia.

Introduction

2min

The Art of Information Gathering by TA427

9min

Email Security and DMARC Protocol Abuse

5min

Navigating Low-Level Espionage

10min

TA427's Information Gathering Tactics and Cybersecurity Solutions Promotion

2min

Greg Lesnewich, senior threat researcher at Proofpoint, sits down to discuss "From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering." Since 2023, TA427 has directly solicited foreign policy experts for their opinions on nuclear disarmament, US-ROK policies, and sanction topics via benign conversation starting emails.

The research states "While our researchers have consistently observed TA427 rely on social engineering tactics and regularly rotating its email infrastructure, in December 2023 the threat actor began to abuse lax Domain-based Message Authentication, Reporting and Conformance (DMARC) policies to spoof various personas and, in February 2024, began incorporating web beacons for target profiling."

The research can be found here: