TA444 is a North Korean state-sponsored threat actor financially motivated by cryptocurrency theft.
Analyst brief
TA444 is a North Korea state-sponsored threat actor with financial motivation, active since at least 2017. They primarily target the cryptocurrency sector and have been attributed to stealing hundreds of millions of dollars in assets. Their TTPs include diverse infection methods and a broad range of malware and backdoors. Defenders should focus on monitoring phishing campaigns aimed at crypto transactions, suspicious malware deployments, and unusual C2 traffic.
TA444
unknown
TA444 is a North Korea state-sponsored threat actor that primarily focuses on financially motivated operations. They have been active since at least 2017 and have recently shifted their attention to targeting cryptocurrencies. TA444 employs various infection methods and has a diverse range of malware and backdoors at their disposal. They have been attributed to stealing hundreds of millions of dollars' worth of cryptocurrency and related assets.