North Korean APT Group Andariel targeted South Korean construction and machinery companies in April 2024

EuRepoC

North Korean APT Group Andariel targeted South Korean construction and machinery companies in April 2024, according to a joint report from the South Korean National Cyber Security Centre, the National Intelligence Service, and others. According to intelligence agencies, the campaign is twofold: on the one hand, Kimsuky has been targeting the websites of construction agencies with malware hidden in authentication services when a user logs into the website. This allowed Kimsuky to infect the computers of local governments, public institutions, and other construction companies in January 2024. The joint campaign from Andariel started in April. The group exploited vulnerabilities in VPNs to install remote control malware into the systems of construction and machinery companies in South Korea. In this move, the hacker group is said to have succeeded in stealing machine and equipment-related blueprints. The NCSC links the joint Kimsuky-Andariel campaign to North Korea's "Local Development 20x10 Policy," meant to facilitate the building of modern industrial facilities in the DPRK.