Autumn Aperture—malware embedded in antiquated file types

CSIS Significant Cyber Incidents

North Korean hackers were revealed to have conducted a phishing campaign over the summer of 2019 targeted U.S. entities researching the North Korean nuclear program and economic sanctions against North Korea.

CFR Cyber Operations Tracker

A threat actor targeted U.S.-based entities by emailing them malware-laced Microsoft Word documents written by industry experts. The trojanized documents discussed nuclear deterrence, North Korea’s nuclear submarine program, and economic sanctions on the North Korean regime. This incident is believed to be an extension of the August Autumn Aperture campaign.

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers from Prevailion uncover “Autumn Aperture”, an ongoing, sophisticated malware campaign aiming at U.S.-based targets with an interest in nuclear deterrence, North Korea’s nuclear submarine program and North Korean economic sanctions.

North Korean hackers were revealed to have conducted a phishing campaign over the summer of 2019 targeted U.S. entities researching the North Korean nuclear program and economic sanctions against North Korea.

Prevailion links — with moderate confidence — the action to a group known as Kimsuky or Smoke Screen.