Randolph Air Force Base · 2022-04
Randolph Air Force Base was listed among U.S. Air Force and government targets in an alleged Andariel conspiracy tied to DPRK Reconnaissance General Bureau operators who financed further intrusions with laundered Maui ransomware proceeds. The broader activity involved exploitation of unpatched known vulnerabilities, including Log4Shell, and theft of sensitive data such as U.S. government employee information and military aircraft-related technical information.
North Korean state-sponsored threat actor Andariel attacked two US air force bases and stole data in April 2022 · 01.04.2022
Andariel, a state-sponsored North Korean threat actor, stole data from each the systems of two US air force bases in April 2022, as indicated by an indictment on 24 July 2024. The incident resulted in the exfiltration of 1 GB of unclassified data from each of the systems at Randolph Air Force Base in Texas and Robins Air Force Base in Georgia and exploited the Log4Shell vulnerability (CVE-2021-44228). The threat actors were able to maintain access over ten days at Randolph Air Force Base respectively two weeks at Robins Air Force Base before the vulnerability was mitigated. The indictment unsealed by the US Department of Justice charged Rim Jong Hyok for the breaches, who was identified as working for North Korea's primary military intelligence agency, the Reconnaissance General Bureau (RGB). Rim is deemed to have operated from RGB offices in Pyongyang and Sinuiju.
Intrusions into two U.S. Air Force bases, NASA-OIG, entities in Taiwan, South Korea, China
Victims of this further hacking include two U.S. Air Force bases, NASA-OIG, and entities located in Taiwan, South Korea, and China.
Intrusion into Randolph Air Force Base via Log4Shell; data exfiltration · In or around April 2022
In or around April 2022, Conspirators used Virtual Private Server 2 and exploited the Log4Shell vulnerability to gain and retain unauthorized access for over two weeks to Randolph Air Force Base's computer system ... The Conspirators extracted nearly a gigabyte of unclassified data. [Case No. 2:24-cr-20061, U.S. District Court for the District of Kansas; filing: INDICTMENT filed against Rim Jong Hyok as to counts 1, 2.]