South Korean Manufacturing Company · 2023-03
The South Korean manufacturing intrusion was included in a U.S. Justice Department case charging Rim Jong Hyok and co-conspirators over an Andariel campaign tied to North Korea’s Reconnaissance General Bureau. The indictment alleged that proceeds from Maui ransomware extortion were laundered through China-based facilitators and used to lease infrastructure for further intrusions, including against South Korean manufacturing, defense, technology, government, and energy targets, with exploitation of known vulnerabilities such as Log4Shell and theft of sensitive data.
Ransomware attack on "South Korean Manufacturing Company" · In or around March 2023 (payment April 12, 2023)
In or around March 2023, Conspirators gained unauthorized access to the South Korean Manufacturing Company's computer system and encrypted the company's electronic files. ... On April 12, 2023, a payment of 4.3 Bitcoin was transferred to the Conspirators on behalf of the South Korean Manufacturing Company. [Case No. 2:24-cr-20061, U.S. District Court for the District of Kansas; filing: INDICTMENT filed against Rim Jong Hyok as to counts 1, 2.]
Ransomware negotiation email provided to a South Korean victim company · March 2023
tayronqxhardy07@gmail.com was also the email address provided by DPRK co-conspirators to a South Korean victim company in March 2023 for ransomware negotiations. [Case No. 6:26-cv-01047, U.S. District Court for the District of Kansas; filing: COMPLAINT with trial location of Wichita, filed by United States of America.]
Ransomware attack on South Korean Manufacturing Company; ransom laundered via MEXC accounts · In late March of 2023 (payment April 12, 2023)
In late March of 2023, South Korean Manufacturing Company was the victim of a ransomware attack. ... The FBI confirmed that on April 12, 2023, a ransom payment of 4.29 BTC (approximately $130,000) was made on behalf of the victim to the bc1q9zh address. [Case No. 2:24-mj-08113, U.S. District Court for the District of Kansas; filing: APPLICATION FOR SEIZURE WARRANT as to User ID account 4690943.]