North Korean hacking group 'Andariel' obsessed with hacking for nuclear weapons development… also profits by spreading ransomware

2024.07.31. The Fair Economy — The National Intelligence Service and the Korean National Police Agency, together with the U.S. Federal Bureau of Investigation (FBI), USCYBERCOM (CNMF), the Cybersecurity and Infrastructure Security Agency (CISA), the Defense Cyber Crime Center (DC3), the National Security Agency (NSA), and the UK's National Cyber Security Center (NCSC), recently issued a joint cybersecurity advisory titled "North Korean Hacking Organizations: Global Hacking Activities for the Regime's Military and Nuclear Weapons Development."

This advisory aims to highlight hacking activities linked to the Third Bureau of North Korea's Reconnaissance General Bureau, based in Pyongyang and Sinuiju.

The Andariel hacking group under North Korea's Reconnaissance General Bureau is known by names such as Onyx Sleet (formerly Plutonium), Dark Seoul, Silent Chollima, and Stonefly/Clasiopa. This group primarily targets defense, aerospace, nuclear, and maritime engineering institutions worldwide to steal sensitive technology and intellectual property for the military and nuclear weapons development of Kim Jeong-eun's North Korean regime.

The agencies that issued the advisory stated, "We assess that techniques similar to those used by this group continue to pose a persistent threat to various industries and countries worldwide, including networks and companies in Japan and India," adding, "RGB Bureau 3 actors are funding their espionage activities by deploying ransomware against U.S. healthcare organizations."

Attackers exploit known vulnerabilities such as Log4j to carry out widespread attacks on web servers, deploying web shells to gain access to critical information and applications and enable further attacks. They explore systems and gather information, register tasks in task schedulers to maintain persistence, and use credential-theft tools such as Mimikatz to obtain privileges. The attackers employ self-modified malware implants, remote access tools (RATs), and open-source tools at every stage of execution, lateral movement, and data exfiltration.

In phishing operations, attackers use ZIP archive files (with an optional password) containing Microsoft Windows shortcut files (LNK) or HTML application (HTA) script files as attachments.

The agencies that issued the advisory recommended that critical infrastructure organizations apply patches for vulnerabilities in a timely manner, protect web servers from webshells, monitor endpoints for malicious activity, and strengthen authentication and remote access security.

They also stressed that targeted organizations must remain vigilant in defending their networks against North Korean state-sponsored hacking.

For additional information on North Korea's malicious cyber activity, readers can refer to CISA's "North Korea Cyber Threat Overview and Advisories" webpage.