DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Michigan Defense Company

Date (as written)
2022-04
Year
2022
Country
United States
Actors (as written)
Andariel
Actor pages
Andariel
Tags (as written)
DataBreach Defense

Source entries (2)

lazarus.day

Michigan Defense Company · 2022-04
A Michigan defense company was included among U.S. defense, technology, and government targets allegedly compromised by Andariel-linked operators after ransom proceeds from Maui ransomware attacks were laundered and used to lease infrastructure for follow-on intrusions. The indictment described exploitation of unpatched known vulnerabilities, including Log4Shell, and theft across the broader campaign of sensitive data such as government employee information, military aircraft-related technical information, intellectual property, and maritime and uranium-processing information.
https://lazarus.day/incidents/michigandefense/

US court filing via CourtListener RECAP: United States v. Hyok

Intrusion into "Michigan Defense Company" (military equipment) · Beginning in or around April 2022
Beginning in or around April 2022, Conspirators used Virtual Private Server 2 and the same malware script used in the NASA hack to gain and retain unauthorized access for seven months to the Michigan Defense Company's computer network. [Case No. 2:24-cr-20061, U.S. District Court for the District of Kansas; filing: INDICTMENT filed against Rim Jong Hyok as to counts 1, 2.]
https://storage.courtlistener.com/recap/gov.uscourts.ksd.153552/gov.uscourts.ksd.153552.1.0.pdf

Suggest a correction on GitHub