Seoul Metro

lazarus.day

Seoul Metro reported a multi-month compromise of office PC management infrastructure for subway lines 1 through 4, affecting 58 infected PCs, abnormal access involving 213 PCs, and loss of control over PC management and webzine servers. Investigators said 12 internal business documents were exfiltrated and South Korea's National Intelligence Service assessed the activity as likely linked to North Korea's Reconnaissance General Bureau, while Seoul Metro stated the affected office systems were separated from train-control and signaling networks.

EuRepoC

According to the Government of Seoul, the NorthKorea is the mainsuspect for a cyberattack that 2014 hit the South Korean capital’s subwaysystem. The attack, staged between March and August 2014, affected several servers of Seoul Metro.

Dyadic Cyber Incident Dataset v2

Seoul subway network hacked, sensistive info stolen, future disruptions expected

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

A threat actor compromised networks associated with Seoul's subway system.

CFR Cyber Operations Tracker

A threat actor compromised networks associated with Seoul’s subway system.

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Reported: 2014-07; Victims: Seoul Metro; Motivations: Espionage; Sectors: Transportation; Countries: Korea, Republic of

국정원은 전화를 통해 작년 9월 메트로에 이번 해킹 수법이 2013년 3월 KBS·MBC 등 방송사, 신한은행·농협 등 금융기관을 해킹했던 것과 동일한 'APT'(Advanced Persistent Threat) 방식으로, 같은 사이버 테러 조직(북한 정찰총국) 소행으로 추정된다고 전했다.