CSIS entry 201

CSIS Significant Cyber Incidents

According to a new report, North Korean hackers breached computer systems at a Russian missile developer for five months in 2022. Analysts could not determine what information may have been taken or viewed.

EuRepoC

The cybersecurity firm SentinelOne assessed with high confidence that North Korean threat actors compromised NPO Mashinostroyeniya's sensitive internal IT infrastructure, using several different methods, in May 2022. Part of Russia's defense industry, NPO is a company designing and developing rockets based in Reutov. ScarCruft, a cyberespionage team associated with North Korea, breached NPO's Linux email server. Intruders also deployed the OpenCarrot backdoor, previously linked to the North Korean APT Lazarus, to further develop their access across the compromised network. SentinelOne's investigation was set off by internal communications an NPO employee mistakenly uploaded to a cybersecurity forum while investigating the breach. Further analysis led to the discovery of the OpenCarrot backdoor. This backdoor enables various functionalities, including proxying communication and the manipulation of filesystems and processes.

ThaiCERT Threat Group Cards

Comrades in Arms? | North Korea Compromises Sanctioned Russian Missile Engineering Company https://www.sentinelone.com/labs/comrades-in-arms-north-korea-compromises-sanctioned-russian-missile-engineering-company/

CFR Cyber Operations Tracker

APT 37, a North Korean threat actor, compromised sensitive networks, including an email server, at the Russian missile design firm NPO Mashinostroyeniya. The company has previously been involved in designing hypersonic missiles and newer generation ballistic missiles.

Wikipedia (English), accessed 2026-10-06

NPO Mashinostroyeniya, a Russian ballistic missile manufacturer was allegedly hacked by the group in 2023, as discovered by SentinelOne.

SentinelOne SentinelLabs

North Korean threat actors attempt to further missile program by compromising sanctioned Russian defense company with OpenCarrot backdoor.

Suspected victims: NPO Mashinostroyeniya, a Russian missile design firm

APT 37, a North Korean threat actor, compromised sensitive networks, including an email server, at the Russian missile design firm NPO Mashinostroyeniya.

The researchers attributed the hack to the North Korean cyberespionage group ScarCruft, which breached the enterprise's email server, and the notorious Lazarus group, which installed digital backdoors into its systems.