North Korean state-sponsored APT Lazarus Group hacked into unnamed South Korean defence company and stole data starting in November 2022

EuRepoC

As reported on 23 April 2024 by the South Korean National Police Agency, the North Korean APT, Lazarus Group, infiltrated the systems of an unnamed South Korean defence company in November 2022, as part of a year-and-a-half-long coordinated espionage campaign alongside two other North Korean APTs, Andariel and Kimsuky. In the November 2022 breach, Lazarus hacked into the external network of the unnamed defence company and infected it with malicious code, thus enabling the group to gain access to internal networks through network systems that were left open for testing. Within the internal network, the group stole data and exported it to external servers abroad. According to the National Police Agency, the aforementioned year-and-a-half-long campaign that the Lazarus hack took place within ultimately affected 10 South Korean defence organisations.