US Sanctions Against N. Korean Hacking Groups

The United States Treasury Department recently announced sanctions against three state-sponsored North Korean hacking groups that have been cyberattacking some US critical infrastructureThese hacking groups have also been accused of stealing possibly hundreds of millions of dollars from financial institutions around the world in order to fund the North Korean illicit weapons and missile programs. 

The three North Korean hacking groups in question are the well-known Lazarus Group, and its two sub-groups, Bluenoroff and Andariel.

The sanctions announced by the Treasury Department's Office of Foreign Assets Control (OFAC) claim that all the three groups are "agencies, instrumentalities, or controlled entities of the Government of North Korea" based on their relationship with Pyongyang's central intelligence bureau called the Reconnaissance General Bureau (RGB).

Specifically, the sanctions aim to lock any foreign financial institution who knowingly facilitated significant transactions or services for these hacking groups and freeze any asset associated with these three groups.

Hidden Cobra
The well-known group out of all is Lazarus Group, also known as Hidden Cobra and Guardians of Peace, that has allegedly been associated with several high-profile cyber-attacks, including Sony Pictures hack in 2014 and the WannaCry attack in 2017.

According to the Treasury's OFAC, the WannaCry attack hit several organizations in at least 150 countries, including the United States, Australia, Canada, New Zealand, and the United Kingdom, and shut down about 300,000 computers.
However, the fatal Wannacry hit was against the UK's National Health Service (NHS), with hospitals that provide intensive care units and other emergency services virtually shut down and over 19,000 appointments canceled, which cost the NHS more than $112 million.

The US Department of Justice last year also announced criminal charges against a N. Korean computer programmer, named Park Jin Hyok, in connection with the WannaCry ransomware attacks and Sony Pictures hack.

Bluenoroff
According to the Treasury Department, the Lazarus group formed its first sub-group, called Bluenoroff, specifically to obtain revenue for the North Korean government by targeting financial institutions around the world.

Since at least 2014, Bluenoroff had targeted the Society for Worldwide Interbank Financial Telecommunication (SWIFT), financial institutions, and cryptocurrency exchanges, using a variety of tactics like phishing and backdoor intrusions.
The group had successfully carried out such operations against over 16 organisations across 11 countries, including Bangladesh, India, Mexico, Pakistan, Philippines, South Korea, Taiwan, Turkey, Chile, and Vietnam.

Bluenoroff's most notorious cyber-attack involving SWIFT being against the Central Bank of Bangladesh's New York Federal Reserve in 2016, when the group worked with Lazarus Group to take $81m from the Reserve account, while it attempted to steal $851m. 

Anadriel 
The second Lazarus Group sub-group, Andariel, has been specialised in conducting malicious cyber operations against foreign businesses, government agencies, financial services, private corporations, and the defense industry. 

Andariel was "observed by cyber-security firms attempting to steal bank card information by hacking into ATMs to withdraw cash or steal customer information to later sell on the black market," the Treasury said.The Treasury also said Andariel hackers created unique malware to hack online poker and gambling sites to steal cash. However, besides its criminal activities, Andariel continues to conduct cyber-attacks against South Korea government personnel and the South Korean military in an effort to gather intelligence and create disorder.

"One case spotted in September 2016 was a cyber intrusion into the personal computer of the South Korean Defense Minister in the office at that time and the Defense Ministry's intranet in order to extract military operations intelligence," the US Treasury said.

In addition, these three state-sponsored hacking groups likely managed to steal around $571 million in cryptocurrency alone, from at least five cryptocurrency exchanges in Asia between January 2017 and September 2018. 

The sanctioning of the three groups are the latest efforts of the US government to hold North Korean hackers accountable for cyber-attacks and to protect US financial systems and critical infrastructure against cyber-threats.

The Hacker News

You Might Also Read:

America Remains Vulnerable To Cyber Attack:

N. Korea Employs Grads For Cyber Warfare:

 

 

« Will Robots Be Allowed To Kill?
AI Is Changing The Cyber Security Landscape »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

DFLabs

DFLabs

DFlabs is a pioneer in Security Automation & Orchestration technology, leveraging your existing security products to dramatically reduce the response and remediation gap.

GreatHorn

GreatHorn

GreatHorn offers the only cloud-native security platform that stops targeted social engineering and phishing attacks on communication tools like O365, G Suite, and Slack.

Network Box

Network Box

Network Box is one of the world's leading Managed Security Service Providers.

Micro Strategies Inc.

Micro Strategies Inc.

Micro Strategies provides IT solutions that help businesses tackle digital transformation in style.

SECURITI.ai

SECURITI.ai

SECURITI.ai's PrivacyOps platform is a full-stack solution that operationalizes and simplifies privacy compliance using robotic automation and a natural language interface.

ISTC Foundation

ISTC Foundation

ISTC Foundation is one of the leading innovation centers in Armenia, founded by joint initiative of IBM, USAID, Armenian Government and Enterprise Incubator Foundation.

Quside

Quside

Quside, a spin-off from The Institute of Photonic Sciences in Barcelona, designs and manufactures innovative quantum technologies for a wide range of applications including cyber security.

Exceed Cybersecurity & I.T. Services

Exceed Cybersecurity & I.T. Services

Exceed Cybersecurity & I.T. Services is a premier Managed Internet Technology (I.T.) company with a focus in cybersecurity risk management and CMMC compliance management.

Randaemon

Randaemon

RANDAEMON’s mission is to create True Random Number Generators (TRNG) that are hardware-based and integrated into System-on-Chip.

Josef Ressel Centre for Intelligent & Secure Industrial Automation

Josef Ressel Centre for Intelligent & Secure Industrial Automation

The Josef Ressel Centre for Intelligent and Secure Industrial Automation investigates the fundamentals of digital assistants for industrial machines that enable intelligent and secure operation.

Open Web Application Security Project (OWASP)

Open Web Application Security Project (OWASP)

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software.

UM6P Ventures

UM6P Ventures

UM6P Ventures is an African based early-stage ventures firm operating two funds; a Digital Transformation fund and a Deeptech Ventures fund.

Chugach Government Solutions (CGS)

Chugach Government Solutions (CGS)

CGS performs work for the Federal Government across 4 unique core lines of business, including: Facilities Management and Maintenance, Construction, Technical IT and Cyber Services, and Educational Se

US Department of State - Bureau of Cyberspace & Digital Policy

US Department of State - Bureau of Cyberspace & Digital Policy

The Bureau of Cyberspace and Digital Policy leads and coordinates the Department’s work on cyberspace and digital diplomacy to encourage responsible state behavior in cyberspace.

c0c0n

c0c0n

c0c0n is the longest running conferences in the area of Information Security and Hacking, in India.

ARGOS Cloud Security

ARGOS Cloud Security

ARGOS aims to simplify and strengthen cloud security, by creating a visual map of security vulnerabilities, to your priceless information stored in any cloud provider environment.