State-sponsored North Korean hacker group Andariel stole sensitive information from South Korean defense companies as well as research institutes and pharmaceutical companies since at least 22 December 2022

EuRepoC

The state-sponsored North Korean hacker group Andariel stole sensitive information from South Korean defence companies as well as research institutes and pharmaceutical companies, tracing back to at least 22 December 2022 and continuing at least until 23 March 2023, the Seoul Metropolitan Police Agency's (SMPA) National Security Investigation Support Division assessed in cooperation with the FBI in a press release released on 5 December. Andariel is suspected to have stolen 1.2TB worth of data in addition to extorting money from the affected companies. The collected ransom is believed to have been laundered via the bank account of an individual only identified as Ms. A. by law enforcement. Police in South Korea seized servers, cell phones and laptops allegedly used by the group and searched the apartment of the woman, described as a foreigner.

CFR Cyber Operations Tracker

The Seoul Metropolitan Police said that Lazarus Group had broken into the networks of several companies connected to the South Korean defense industry and managed to steal sensitive information about anti-aircraft systems the companies manufacture or design.

investigators found the group extorted three ransomware victims in South Korea and abroad for about $357,000 worth of Bitcoin.

Investigators tracked paid ransoms on the cryptocurrency platforms Binance and Bithumb, including about $76,000 transferred into an account at a Chinese bank