Edward Kiledjian

North Korea's cyber capabilities have seen a dramatic evolution over the past decade, now posing a serious challenge for governments and organizations worldwide. This article takes a closer look at the key North Korean Advanced Persistent Threat (APT) groups, their tactics, and the impact they have on global cybersecurity.

A Brief History and Evolution

North Korea's foray into cyber warfare began in the mid-1990s when the Korean People's Army (KPA) started studying "electronic intelligence warfare" concepts from China's People's Liberation Army. By 1995, then-supreme leader Kim Jong Il directed the KPA General Staff to develop 'information warfare' capabilities.

In September 1998, North Korea established Unit 121 within the Staff Reconnaissance Bureau of the KPA. Initially staffed by 500 to 1,000 members, this unit focused on developing cyberattack techniques, software engineering, cryptography, and networking. Recruits were drawn from leading technology institutions such as Pyongyang University of Automation, Amrokgang College of Military Engineering, National Defense University, and Pyongyang Computer Technology University.

Active Groups

Several prominent North Korean APT groups are currently making their mark:

• Andariel (UNC614): Targets include foreign businesses, government agencies, financial services, private corporations, and the defence industry. This group is also involved in cybercrime, such as using the MAUI ransomware to ransom hospitals.

• TEMP.Hermit (Lazarus Group): Active since at least 2013, Lazarus focuses on gathering strategic intelligence to benefit North Korean interests, targeting government, defence, telecommunications, and financial institutions globally.

• APT38: Known for large-scale financial cyber heists, APT38 shares resources with the Lazarus Group. However, its distinct financial motivation and unique toolset set it apart.

• APT37 (Scarcruft/Group123): Primarily targets South Korea, Japan, Vietnam, and the Middle East across various industries. This group has access to zero-day vulnerabilities and wiper malware.

• Kimsuky (APT43): Engages in targeted campaigns to collect strategic intelligence on geopolitical events and negotiations that affect North Korea's interests.

Techniques, Tactics, and Procedures (TTPs)

North Korean APT groups employ a broad spectrum of sophisticated tactics:

• Spear-phishing: Crafting targeted emails with malicious links or attachments. For instance, Kimsuky has posed as South Korean reporters to arrange fake interviews with their targets.

• Zero-day exploits: Leveraging previously unknown vulnerabilities in software. APT37 is notorious for using zero-day vulnerabilities in their attacks.

• Watering hole attacks: Compromising websites frequented by their targets.

• Custom malware: Developing and deploying a range of custom malware families, including backdoors, tunnelers, dataminers, and destructive malware. APT38, in particular, is known for its destructive capabilities.

• Living off the land: Using legitimate tools and services to evade detection.

• Supply chain attacks: Compromising software supply chains to reach their targets.

• Cryptocurrency theft: Targeting cryptocurrency exchanges and related infrastructure. APT38 has been notably active in this area, attempting to steal over $1.1 billion from financial institutions.

• Long-term persistence: APT38 has been observed to remain within a victim network for an average of 155 days, with the longest duration being almost two years.

Targets and Motivations

North Korean cyber operations primarily aim to achieve two key objectives:

1. Information collection: Gaining insights into adversaries' strategies and accessing technology that could provide a strategic advantage during conflicts. APT37, for example, focuses on covert intelligence gathering to support North Korea's strategic military, political, and economic interests.

2. Financial theft: Funding the regime's activities, including its nuclear and missile programs. APT38 is particularly focused on financial crime, having attempted to steal over $1.1 billion from financial institutions globally.

Key targets include:

• South Korea: A primary target for most North Korean APT groups, especially APT37 and Kimsuky.

• United States: Government agencies, defence contractors, and critical infrastructure are frequent targets.

• Japan: Targeted for its geopolitical significance and technological advancements.

• Cryptocurrency exchanges: Targeted by groups like APT38 for financial gain.

• Defence and aerospace industries: Targeted for technological intelligence.

• Financial institutions: Banks and other financial organizations are primary targets for APT38.

• Think tanks and academic institutions: Targeted for intelligence on foreign policy and national security issues.

Conclusion

North Korea's cyber APT groups represent a significant and evolving threat in the digital landscape. Their ability to adapt, share resources, and target a broad range of industries across various countries makes them a formidable adversary. It's crucial for organizations to stay vigilant and implement robust cybersecurity measures to guard against these sophisticated threat actors.

As the global community continues to monitor and analyze North Korean cyber activities, collaboration and threat intelligence sharing between businesses and governments will be key to enhancing our collective cybersecurity posture against these persistent threats.