US, South Korea: Ransomware Attacks Fund North Korea’s Cyber Operations

us,-south-korea:-ransomware-attacks-fund-north-korea’s-cyber-operations

The United States and South Korea have issued a joint advisory on ransomware attacks on critical infrastructure that are funding North Korea’s malicious cyber activities.

North Korean government-backed threat actors have been using ransomware in attacks against critical infrastructure for years, with at least two ransomware families attributed to them, namely Maui and H0lyGh0st.

In July last year, the US government issued a warning on North Korea’s use of Maui ransomware in attacks targeting healthcare and public health sectors.

This week, the US and South Korea issued an updated advisory, warning that North Korea is relying on ransomware attacks against healthcare and other critical infrastructure organizations to fund various objectives, including malicious cyber operations.

Typically, after compromising an organization’s network, the threat actors deploy ransomware and use it to encrypt the victim’s files. The attackers then demand a ransom to be paid in cryptocurrency in exchange for a decryption key.

“The authoring agencies assess that an unspecified amount of revenue from these cryptocurrency operations supports DPRK national-level priorities and objectives, including cyber operations targeting the United States and South Korea governments,” the alert reads.

As part of the observed ransomware operations, the North Korean threat actors build infrastructure (domains, online personas and accounts) and rely on cryptocurrency services to receive ransom proceeds that are then used to procure infrastructure for other malicious activities.

The attackers attempt to hide their identity by operating with or under third-party foreign affiliate identities, use intermediaries to receive ransom payments, and use virtual private networks (VPNs) and virtual private servers (VPSs) to hide their real IP addresses.

The threat actors have been observed exploiting known vulnerabilities for initial access, including Apache Log4j and SonicWall security bugs, but also deploying malware via trojanized files in attacks targeting small and medium-size hospitals in South Korea.

Following initial access, the attackers perform reconnaissance and lateral movement, and then deploy either custom ransomware, such as Maui and H0lyGh0st, or publicly available tools, including BitLocker, Deadbolt, Hidden Tear, Jigsaw, LockBit, Ryuk, and others.

Typically, North Korean threat actors demand from their victims a ransom in Bitcoin and communicate with them via Proton Mail email accounts.

Organizations are advised to encrypt connections with all devices on the network, implement the principle of least privilege, turn off unused network protocols and services, secure the collection, transfer and storing of personally identifiable and protected healthcare information (PII and PHI), implement multi-layer network segmentation, and monitor networks for suspicious behavior.

Furthermore, organizations should keep isolated data backups, should implement a cyber incident response plan, should keep all applications and operating systems updated, enforce strong passwords and multi-factor authentication, educate employees and users on phishing, and make sure that all remote desktop protocol (RDP) and similar connections are monitored and secured.

Related: US Disrupts North Korean Hackers That Targeted Hospitals

Related: US Healthcare Organizations Warned of ‘Daixin Team’ Ransomware Attacks

Related: US Says Chinese Military Behind Vast Aerial Spy Program

The post US, South Korea: Ransomware Attacks Fund North Korea’s Cyber Operations appeared first on SecurityWeek.

UN Experts: North Korean Hackers Stole Record Virtual Assets

un-experts:-north-korean-hackers-stole-record-virtual-assets

North Korean hackers working for the government stole record-breaking virtual assets last year estimated to be worth between $630 million and more than $1 billion, U.N. experts said in a new report.

The panel of experts said in the wide-ranging report seen Tuesday by The Associated Press that the hackers used increasingly sophisticated techniques to gain access to digital networks involved in cyberfinance, and to steal information that could be useful in North Korea’s nuclear and ballistic missile programs from governments, individuals and companies.

With growing tensions on the Korean Peninsula, the report said North Korea continued to violate U.N. sanctions, producing weapons-grade nuclear material, and improving its ballistic missile program, which “continued to accelerate dramatically.”

In 2022, the Democratic People’s Republic of Korea – the North’s official name – launched at least 73 ballistic missiles and missiles combining ballistic and guidance technologies including eight intercontinental ballistic missiles, the panel said. And 42 launches, including the test of a reportedly new type of ICBM and a new solid-fueled ICBM engine, were conducted in the last four months of the year.

North Korea’s leader Kim Jong Un ordered an “exponential increase of the country’s nuclear arsenal” in January, and the panel said “a new law discussed an increased focus on tactical nuclear capability, a new first-use doctrine, and the `irreversible nature’ of the DPRK’s nuclear status.”

“The ability to carry out an unexpected nuclear strike on any regional or international target, described in DPRK’s new law on nuclear doctrine and progressively in public statements since 2021, is consistent with the observed production, testing, and deployment of its tactical and strategic delivery systems,” the experts said in the report to the U.N. Security Council.

{ Read: North Korean APT Expands Its Attack Repertoire }

The panel said that South Korean authorities quoted in media reports “estimated that state sponsored DPRK cyber threat actors had stolen virtual assets worth around $1.2 billion globally since 2017, including about $630 million in 2022 alone.”

The experts monitoring sanctions against North Korea said an unnamed cybersecurity firm “assessed that in 2022, DPRK cybercrime yielded cyber currencies worth over $1 billion at the time of the threat, which is more than double the total proceeds in 2021.”

The variation in the U.S. dollar value of cryptocurrency in recent months is likely to have affected these estimates, the panel said, “but both show that 2022 was a record-breaking year for DPRK virtual asset theft.”

The panel said three groups that are part of the Reconnaissance General Bureau, North Korea’s primary foreign intelligence organization, “continued illicitly to target victims to generate revenue and solicit information of value to the DPRK including its weapons programs” – Kimsuky, Lazarus Group and Andariel.

Between February and July 2022, the panel said, the Lazarus Group “reportedly targeted energy providers in multiple member states using a vulnerability” to install malware and gain long-term access. It said this “aligns with historical Lazarus intrusions targeting critical infrastructure and energy companies … to siphon off proprietary intellectual property.”

Lazarus Group’s primary focus is on specific types of industry, aerospace and defense and conventional finance and cryptocurrencies, with the objective of accessing the internal knowledge bases of the compromised companies, the experts said. They quoted the cybersecurity section of an internet technology company as saying Lazarus has been targeting engineers and technical support employees “using malicious versions of open source applications.”

In December 2022, the panel said, South Korea’s national police agency announced that Kimsuky had targeted 892 foreign policy related experts “in an effort to steal personal data and email lists.”

The police reported that the hackers didn’t manage to steal sensitive information, but they “laundered IP addresses of the victims and employed 326 detour servers and 26 member states to make tracing difficult,” the experts said. The police noted it was the first time they detected Kimsuky using ransomware, saying 19 servers and 13 businesses were affected, of which two paid 2.5 million South Korean won ($1,980) in Bitcoin to the hackers.

On military-related issues, the experts said they investigated the “apparent export” of military communications equipment from a North Korean company under U.N. sanctions to Ethiopia’s defense ministry in June 2022.

The panel said it has not yet received a reply from Ethiopia’s government about a photo published by the Ethiopian media in November allegedly showing a piece of equipment from the Global Communications Co., known as Glocom, being used by a top military official. Eritrea also hasn’t responded to questions about its alleged procurement of Glocom equipment, the experts said.

North Korea may also have illegally traded arms and related material with a number of countries, including sending artillery shells, infantry rockets and missiles to Russia – claims Pyongyang and Moscow have consistently denied, the panel said. And the experts said they are investigating the reported sale of weapons from a North Korean company on the U.N. sanctions list to the Myanmar military through a Myanmar company.

The post UN Experts: North Korean Hackers Stole Record Virtual Assets appeared first on SecurityWeek.