North Korean state-sponsored APT Andariel stole data from unnamed South Korean defence manufacturer through accessing maintenance/repair partner, starting in October 2022

EuRepoC

As reported on 23 April 2024 by the South Korean National Police Agency, the North Korean APT, Andariel, infiltrated the systems of an unnamed South Korean defence company in October 2022, as part of a year-and-a-half-long coordinated espionage campaign alongside two other North Korean APTs, Lazarus and Kimsuky. In the October 2022 breach, Andariel gained access to an employee's email account from an unnamed partner which maintains and repairs equipment from the aforementioned unnamed defence company. Through this, Andariel was able to steal data that was sent via email and was further able to install malware onto the defence company's computers, enabling the theft of more data directly from the defence company's servers. According to the National Police Agency, the aforementioned year-and-a-half-long campaign that the Andariel hack took place within ultimately affected 10 South Korean defence organisations.