DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

North Korea?

Date (as written)
21/08/2019
Year
2019
Country
>1
Actors (as written)
?
Actor pages
Kimsuky
Tags (as written)
Attack: Targeted Attack; Target Class: O Public administration and defence, compulsory social security; Attack Class: CE; Tags: North Korea, Anomali

Source entries (11)

CSIS Significant Cyber Incidents

CSIS entry 697 · August 2019
North Korean hackers conducted a phishing campaign against foreign affairs officials in at least three countries, with a focus on those studying North Korean nuclear efforts and related international sanctions.
https://csis-website-prod.s3.amazonaws.com/s3fs-public/2026-07/260706_Significant_Cyber_Events.pdf?VersionId=1Li2342elpx5OV3lnGEYyXXB_LRbGnPm

ThaiCERT Threat Group Cards

Suspected North Korean Cyber Espionage Campaign Targets Multiple Foreign Ministries and Think Tanks · 2019-08
Suspected North Korean Cyber Espionage Campaign Targets Multiple Foreign Ministries and Think Tanks https://www.anomali.com/blog/suspected-north-korean-cyber-espionage-campaign-targets-multiple-foreign-ministries-and-think-tanks#When:14:00:00Z
https://www.anomali.com/blog/suspected-north-korean-cyber-espionage-campaign-targets-multiple-foreign-ministries-and-think-tanks#When:14:00:00Z

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Congressional Research Service · 2019-08-22
A threat actor targeted a number of foreign ministries, a Chinese technology company, Stanford University, think tanks in the United States and the United Kingdom, and other entities that have focused on North Korea's nuclear efforts or the related international sanctions. The threat actor created a network of malicious websites imitating the login portals of targets.
https://www.cyberscoop.com/north-korean-hacking-espionage-phishing/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Royal United Services Institute · 2019-08-22
A threat actor targeted a number of foreign ministries, a Chinese technology company, Stanford University, think tanks in the United States and the United Kingdom, and other entities that have focused on North Korea's nuclear efforts or the related international sanctions. The threat actor created a network of malicious websites imitating the login portals of targets.
https://www.cyberscoop.com/north-korean-hacking-espionage-phishing/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

South African Department of International Relations and Cooperation · 2019-08-22
A threat actor targeted a number of foreign ministries, a Chinese technology company, Stanford University, think tanks in the United States and the United Kingdom, and other entities that have focused on North Korea's nuclear efforts or the related international sanctions. The threat actor created a network of malicious websites imitating the login portals of targets.
https://www.cyberscoop.com/north-korean-hacking-espionage-phishing/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Sina · 2019-08-22
A threat actor targeted a number of foreign ministries, a Chinese technology company, Stanford University, think tanks in the United States and the United Kingdom, and other entities that have focused on North Korea's nuclear efforts or the related international sanctions. The threat actor created a network of malicious websites imitating the login portals of targets.
https://www.cyberscoop.com/north-korean-hacking-espionage-phishing/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Stanford University · 2019-08-22
A threat actor targeted a number of foreign ministries, a Chinese technology company, Stanford University, think tanks in the United States and the United Kingdom, and other entities that have focused on North Korea's nuclear efforts or the related international sanctions. The threat actor created a network of malicious websites imitating the login portals of targets.
https://www.cyberscoop.com/north-korean-hacking-espionage-phishing/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Ministry of Foreign and European Affairs of the Slovak Republic · 2019-08-22
A threat actor targeted a number of foreign ministries, a Chinese technology company, Stanford University, think tanks in the United States and the United Kingdom, and other entities that have focused on North Korea's nuclear efforts or the related international sanctions. The threat actor created a network of malicious websites imitating the login portals of targets.
https://www.cyberscoop.com/north-korean-hacking-espionage-phishing/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

French Ministry for Europe and European Affairs · 2019-08-22
A threat actor targeted a number of foreign ministries, a Chinese technology company, Stanford University, think tanks in the United States and the United Kingdom, and other entities that have focused on North Korea's nuclear efforts or the related international sanctions. The threat actor created a network of malicious websites imitating the login portals of targets.
https://www.cyberscoop.com/north-korean-hacking-espionage-phishing/

CFR Cyber Operations Tracker

Autumn Aperture—use of malicious websites to target foreign ministries and other entities · Aug 2019
A threat actor targeted a number of foreign ministries, a Chinese technology company, Stanford University, think tanks in the United States and the United Kingdom, and other entities that have focused on North Korea’s nuclear efforts or the related international sanctions. The threat actor created a network of malicious websites imitating the login portals of targets. This incident is believed to be an extension of the 2018 BabyShark campaign.
https://www.cfr.org/cyber-operations/autumn-aperture-use-of-malicious-websites-to-target-foreign-ministries-and-other-entities
https://www.cyberscoop.com/north-korean-hacking-espionage-phishing/
https://www.anomali.com/blog/suspected-north-korean-cyber-espionage-campaign-targets-multiple-foreign-ministries-and-think-tanks

Hackmageddon cyber attacks timelines (Paolo Passeri)

North Korea? · 21/08/2019
Researchers from Anomali discover a cyber espionage campaign, which may have ties to North Korea, targeting foreign ministries, academic institutions and think thanks that are studying or writing reports about the nation's regime.
https://www.hackmageddon.com/2019/10/03/16-31-august-2019-cyber-attacks-timeline/
https://www.databreachtoday.com/cyber-espionage-campaign-uses-spoofed-websites-a-12945

Values found later for empty fields

country: French; Slovak Republic
malicious websites that appear to be login portals for the French Ministry for Europe and Foreign Affairs, the Ministry of Foreign and European Affairs of the Slovak Republic, Stanford University, and a U.K. think tank, among other targets.
https://cyberscoop.com/north-korean-hacking-espionage-phishing/
actors: Kimsuky
Anomali determined the attackers in this case used the same command-and-control server and the same IP address as the Kimsuky campaign, which Palo Alto Networks and others previously have associated with North Korea.
https://cyberscoop.com/north-korean-hacking-espionage-phishing/

Suggest a correction on GitHub