North Korea's Cyber Army Has A New Battalion

An increasingly sophisticated North Korean cyber-espionage unit is using its skills to widen spying operations into aerospace and defence industries, a new study has revealed.

FireEye, a US private security company that tracks cyber-attackers around the world, has identified a North Korean group, which it names APT37 (Reaper) and which it says is using malware to infiltrate computer networks. The report suggests the group has been active since 2012, but has now graduated to the level of an advanced persistent threat.

Until now, the group has substantially focused its cyber-espionage efforts on South Korea, but FireEye outlines evidence that it “has expanded its operations in both scope and sophistication”.

“We assess with high confidence that this activity is carried out on behalf of the North Korean government,” the report says.

Background

Recently the North Korean hackers hit the systems of the Israeli energy company to attempt to penetrate the best electronic protection systems, South Korea's newspaper Naver reported. According to the company’s experts, the North Korean cyber actors have real capabilities to damage the infrastructure of the United States, Japan and other countries. 

Last year, experts warned that the North Korean cyber army could be far more dangerous to global security than its nuclear missiles. 

“North Korean cyberattacks and other malicious cyber activities pose a risk to critical infrastructure in countries around the world and to the global economy,” the statement said.

Since 2011, Pyongyang has been scaling up its cyber capacities. The North Korean regime is suspected to be exploiting its cyber weapons for political purposes to intimidate its opponents as well as to steal crypto-currency.


North Korean hackers are involved in major cyber offensives

In 2013, the three largest broadcasting companies and two banking institutions of South Korea suffered a massive attack against their systems. According to Shinhan Bank and Nonghyup Bank representatives, about 32,000 computers were infected while internet banking and ATMs stopped working.

While Pyongyang still denies any involvement, cybersecurity experts pointed to North Korean group Lazarus.

In August 2014, North Korea hacked the UK's Channel 4 TV station to prevent the production of a drama depicting the fictional story of a nuclear scientist kidnapped in the country. However, one of the most advanced attacks was the intrusion into the network of Sony Corporation in September 2014. The malware destroyed 70% of information stored in the company’s computers. According to Jim Lewis, senior fellow at the Center for Strategic and International Studies, the attack turned out to be the worst of its type on a company on US soil.

North Korean hackers raise funds for regime 

International sanctions forced Kim Jong-un to look for alternative and illegal sources of financing. By late 2015, the North Korean hackers shifted their attention to the global financial system, according to researchers at BAE Systems, FireEye and Symantec. 

In 2016, they were about to commit the most astonishing bank robbery in history. The cyber-criminals were close to stealing a billion dollars from the Federal Reserve of New York and only a misprint in the word "foundation" kept them from it. 

North Korean state-backed hackers have been also accused of the WannaCry ransomware attack that affected hundreds of thousands of computers worldwide in 2017. Taking into account large amounts of stolen money, it becomes clear that despite the growing political and economic pressure Pyongyang will be able to stay afloat for long.
 
According to the commander of the US forces in South Korea, General Brooks, the North Korean military forces are currently capable of carrying out the most efficient and well-prepared cyber-attacks in the world. Robert Hannigan, former director of the of Britain'd GCHQ spy agency says that as of June 2017, North Korea had 1,700 state-sponsored hackers and more than 5,000 support staff personnel. 

They all operate under the Main Intelligence Department of North Korean Armed Forces, known as Unit 586. The so-called Bureau 121 is the main unit conducting cyberattacks abroad. The US Department of Homeland Security refers to this structure as Hidden Cobra, while private companies gave the common name Lazarus to all North Korean hackers. But no one exactly knows how many different subdivisions the North Korea's cyber-army has.

Earlier this year, cyber-security firm McAfee reported that hackers have targeted organisations involved in the 2018 Pyeongchang Winter Olympics.  The malicious actors attempted to obtain passwords and sensitive financial data.

Some analysts believe that the ongoing talks between Pyongyang and Seoul are Kim Jong-un ruse aimed to distract attention from the North Korea’s nuclear program and its malicious activities in cyberspace. But even if talks go smoothly, Pyongyang will never give up further development of its cyber weapons.

North Korea’s advanced cyber warfare capabilities could be truly scaring and risk escalating the crisis. As international bodies consider enforcing sanctions, Pyongyang continues its campaign of outright theft. Korean Olympic detente won’t last forever. Next time when Kim Jong-Un feels trapped or insulted his cyber army will be ready to wreak havoc.

Infosecurity Magazine:            Guardian

You Might Also Read: 

N Korea Is A Bigger Cyber Threat Than Russia:

Looming Cyber Threats From Russia & N. Korea:

Poor North Korea Is A Cyber Superpower:


 

 

« Corporate Defence Plan Against Cyberattacks
GDPR Will Fuel Criminal Extortion »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

National Defence Radio Establishment (FRA) - Sweden

National Defence Radio Establishment (FRA) - Sweden

The National Defence Radio Establishment (Försvarets Radioanstalt), is the Swedish national authority for Signals Intelligence, also providing Information assurance services to government authorities.

Agari

Agari

Agari is the Trusted Email Identity Company™, protecting brands and people from devastating phishing and socially-engineered attacks.

Guy Carpenter

Guy Carpenter

Guy Carpenter delivers a powerful combination of broking expertise, strategic advisory services, and industry-leading analytics.

ThreatMark

ThreatMark

ThreatMark provides fraud detection solutions for digital banking and payments.

Mantix4

Mantix4

Mantix4’s M4 Cyber Threat Hunting Platform actively defends against cyber threats.

ZenMate

ZenMate

ZenMate is a Virtual Private Network services provider offering secure encrypted access to the internet.

SaferVPN

SaferVPN

SaferVPN is a Virtual Private Network services provider offering secure encrypted access to the internet.

GM Security Technologies

GM Security Technologies

GM Security Technologies provides leading managed security services of the highest quality to every type of individual and organization in Puerto Rico, Caribbean and Latin America.

GV

GV

GV provides venture capital funding to bold new companies in the fields of life science, healthcare, artificial intelligence, robotics, transportation, cyber security and agriculture.

TriagingX

TriagingX

TriagingX successfully created the first generation malware sandbox that is being used by many Fortune 500 companies for daily malware analysis.

Netography

Netography

Netography provides a scalable and reliable platform for detection & remediation of cyber threats found on your network.

CyberScotland

CyberScotland

The CyberScotland Partnership is a collaboration of key strategic stakeholders, brought together to focus efforts on improving cyber resilience across Scotland in a coordinated and coherent way.

Picnic

Picnic

Picnic is a gritty, pioneering team of intelligence and cybersecurity specialists focused on solving the security challenge of our time - social engineering.

Tentacle

Tentacle

Tentacle has developed a configurable data management tool that helps organizations to improve their information security programs and overall security posture.

RADICL

RADICL

RADICL's mission is to give SMBs that serve America's Defense Industrial Base (DIB) access to strong, enterprise-grade cyber security protection.

BreakPoint Labs

BreakPoint Labs

BreakPoint Labs is dedicated to providing the methods and means for sustainable, measurable, and effective cybersecurity operations.