North Korean state-sponsored APT Kimsuky stole technical data from unnamed South Korean defence company via email hack from April to July 2023

EuRepoC

As reported on 23 April 2024 by the South Korean National Police Agency, the North Korean APT, Kimsuky, stole technical data from an unnamed South Korean defence company from April to July 2023, as part of a year-and-a-half-long coordinated espionage campaign alongside two other North Korean APTs, Lazarus and Andariel. To achieve the data theft, Kimsuky gained access to files sent via email to and from an unnamed defence company. Kimsuky allegedly abused an in-house vulnerability (or multiple vulnerabilities) that enabled unauthorized actors to download large files sent via email without logging in, allowing them to steal technical data from the company. According to the National Police Agency, the aforementioned year-and-a-half-long campaign that the Kimsuky hack took place within ultimately affected 10 South Korean defence organisations.