Defense Acquisition Program Administration

lazarus.day

South Korea's Defense Acquisition Program Administration disclosed that 10 internet-connected PCs were compromised in late 2018 after abnormal traffic was identified from agency IP space. Reporting described leaked internal materials, delayed response, and a vendor administrator account in a data-storage prevention solution as a suspected intrusion path, with private security sources saying the method resembled North Korean hacker-unit activity.

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Reported: 2018-10; Victims: Defense Acquisition Program Administration; Motivations: Espionage DataBreach; Sectors: Government; Countries: Korea, Republic of

South Korean officials had not attributed the incident, while private security sources assessed that the hacking method resembled activity by North Korean hacker units.