South Korea’s cybersecurity authority has issued a joint advisory with its U.S. and British counterparts against a North Korean cyber group’s espionage campaign, targeting classified information in defense, aerospace, nuclear and engineering sectors.
The advisory was issued by South Korea’s National Intelligence Service (NIS) and National Police Agency, the U.S. National Security Agency, Britain’s National Cyber Security Centre and other related authorities, according to the National Cyber Security Center under the NIS.
The authorities said the cyber group under the North’s Reconnaissance General Bureau, widely known as Andariel, has been targeting defense, aerospace, nuclear and engineering entities worldwide to obtain sensitive and classified technical information and intellectual property.
This information is used to advance North Korea’s military and nuclear capabilities, they added.
“The authoring agencies assess the group has evolved from conducting destructive attacks targeting U.S. and South Kore
an organizations to conducting specialized cyber espionage and ransomware operations,” the advisory read.
Andariel exploits web servers through software vulnerabilities to deploy web shells, gain access and then conduct malware and phishing attacks to extort information, the authorities explained.
The advisory recommends critical infrastructure organizations strengthen their monitoring efforts and enhance their cyber protection systems.
Additionally, they noted that Andariel actors also fund their espionage activities through ransomware attacks on U.S. health care entities.
On Thursday (U.S. time), the U.S. State Department announced a reward of up to US$10 million for information on Rim Jong-hyok, a North Korean national known to be associated with Andariel, accusing him of targeting America’s critical infrastructure, including hospitals, government entities and defense contractors.
U.S. law enforcement investigators have documented that Andariel actors victimized five health care providers, four U.S.-b
ased defense contractors, two U.S. Air Force bases and the National Aeronautics and Space Administration, according to the department.
Last year, Andariel was also found to have stolen digital data containing key technologies from South Korean defense firms and pocketed 470 million won (US$339,154) worth of digital coins via ransomware attacks on other firms.
Source: Yonhap News Agency