State-sponsored North Korean threat actor Andariel targeted NASA and stole data in or around Feburary 2022 · 01.02.2022
The US National Aeronautics and Space Administration (NASA) suffered a data theft in or around February 2022 as it became publicly known through an indictment filed in the District of Kansas on 24 July 2024. The indictment claimed that Andariel, a subgroup of Lazarus with ties to the North Korean military intelligence agency, is behind the incident. The theft of more than 17 GB of unclassified data was enabled by a "previously unseen malware script" allowing the threat actor to remain in NASA's systems for more than three months. The indictment unsealed by the US Department of Justice charged Rim Jong Hyok for the breach, who was identified as working for North Korea's primary military intelligence agency, the Reconnaissance General Bureau (RGB). Rim is deemed to have operated from RGB offices in Pyongyang and Sinuiju.
Intrusion into NASA (Office of Inspector General portal); data exfiltration · In or around February 2022
In or around February 2022, Conspirators used Virtual Private Server 2 and a previously unseen malware script to gain and retain unauthorized access for more than three months to NASA's computer system, specifically the portal for its Office of Inspector General, and extracted over seventeen gigabytes of unclassified data. [Case No. 2:24-cr-20061, U.S. District Court for the District of Kansas; filing: INDICTMENT filed against Rim Jong Hyok as to counts 1, 2.]