Robins Air Force Base · 2022-04
Robins Air Force Base was identified as one of the U.S. Air Force targets in an alleged Andariel-linked campaign where DPRK operators used infrastructure funded by laundered Maui ransomware payments for additional defense, technology, and government intrusions. The indictment alleged exploitation of unpatched known vulnerabilities, including Log4Shell, and theft across the wider operation of sensitive government and military aircraft-related information.
Intrusion into Robins Air Force Base via Log4Shell; data exfiltration · In or around April 2022
In or around April 2022, Conspirators used Virtual Private Server 2 to gain and retain unauthorized access for over ten days to the Robins Air Force Base's computer system, using the Log4Shell vulnerability ... The Conspirators extracted over a gigabyte of unclassified data (such as employee information and passwords) across three separate occasions. [Case No. 2:24-cr-20061, U.S. District Court for the District of Kansas; filing: INDICTMENT filed against Rim Jong Hyok as to counts 1, 2.]