SK/Hanjin

Date (as written): 2016-05
Year: 2016
Country: Korea, Republic of
Actors (as written): Andariel
Actor pages: Andariel
Tags (as written): Espionage DataBreach Defense TCO!Stream

Source entries (7)

lazarus.day

SK/Hanjin · 2016-05

South Korean police attributed the GhostRAT compromise of domestic conglomerate networks to North Korea, reporting more than 130,000 infected computers and malware capable of keystroke logging, host profiling, microphone recording, remote-session control, browser-favorite collection, driver installation, security-product interference, and follow-on payload download. The activity is also preserved in later Lazarus/Andariel-focused case-study material and FSI’s Rifle campaign archive, supporting the existing Andariel attribution for a Korea-focused espionage and defense-relevant intrusion.

https://lazarus.day/incidents/ghostrat/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Hanjin Heavy Industries · 2016-05-11

South Korea points the finger to North Korea after Hanjin Heavy Industries, a navy defence contractor, is hacked.

https://www.theregister.com/2016/05/11/south_korea_fingers_north_for_defence_contractor_hack/

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

SK/Hanjin · 2016-05

Reported: 2016-05; Victims: SK/Hanjin; Motivations: Espionage DataBreach; Sectors: Defense; Countries: Korea, Republic of

https://data.mendeley.com/datasets/wwb2rzgfn7/2

Seoul Shinmun (Yonhap) news

북한, 국내 대기업 전산망 PC 10만대 통제권 탈취 · 2016-06-13 (article date)

북한이 국내 대기업 전산망의 취약점을 뚫고 들어가 10만대가 넘는 PC의 통제권을 탈취, 사상 최대 규모의 사이버 공격을 준비했던 사실이 13일 경찰 수사로 드러났다.

https://www.seoul.co.kr/news/politics/north/2016/06/13/20160613800145

Hackmageddon cyber attacks timelines (Paolo Passeri)

Hanjin Heavy Industries · 11/05/2016

South Korea points the finger to North Korea after Hanjin Heavy Industries, a navy defence contractor. is hacked.

https://www.hackmageddon.com/2016/06/08/1-15-may-2016-cyber-attacks-timeline/

http://www.securityweek.com/sweden-military-servers-hacked-used-2013-attack-us-banks

Hackmageddon cyber attacks timelines (Paolo Passeri)

South Korea · 13/06/2016

North Korea hacked into more than 140,000 computers at 160 South Korean firms and government agencies, planting malicious code under a long-term plan laying groundwork for a massive cyber attack against its rival. The hacking began in 2014 and was detected in February.

https://www.hackmageddon.com/2016/07/07/1-15-june-2016-cyber-attacks-timeline/

http://www.reuters.com/article/us-northkorea-southkorea-cyber-idUSKCN0YZ0BE

Boannews 보안뉴스 (boannews.com)

북한, 국내 대기업 취약점 악용한 대규모 사이버 공격 준비 · 2016-06-13

attribution sentence(s): [보안뉴스 김태형] 북한이 국내 대기업 전산망의 취약점을 뚫고 들어가 10만대가 넘는 PC의 통제권을 탈취, 사상 최대 규모의 사이버 공격을 준비했던 사실이 드러났다. | 경찰청 사이버수사과는 올 1월 북한의 4차 핵실험 직후 사이버테러 관련 첩보 활동을 전개하는 과정에서 이같은 사실을 확인했다고 13일 밝혔다. | 경찰청 사이버수사과에 따르면, 4차 핵실험 직후인 올 2월 북한에서 제작한 것으로 추정되는 악성코드 관련 첩보를 입수, 수사를 진행한 결과 국내 대기업과 공공기관, 정부부처 등 160여 곳에서 사용하는 PC 통합관리망이 뚫린 사실을 확인했다.

https://m.boannews.com/html/detail.html?idx=50911

Suggest a correction on GitHub