DPRK ransomware attacks on Healthcare and Public Health and other critical infrastructure · February 09, 2023
This advisory highlights TTPs and IOCs DPRK cyber actors used to gain access to and conduct ransomware attacks against Healthcare and Public Health (HPH) Sector organizations and other critical infrastructure sector entities, as well as DPRK cyber actors’ use of cryptocurrency to demand ransoms.
13th February – Threat Intelligence Report · 2023-02-13
US and South Korean agencies warn of recent ransomware efforts originating from North Korea. According to the report, North Korean government-sponsored ransomware attacks, specifically targeting the healthcare industry, are used to generate funds for further malicious activity.
Public health and other critical infrastructure sectors in the U.S. · 09/02/2023
A new cybersecurity advisory from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) describes recently observed tactics, techniques, and procedures (TTPs) observed with North Korean ransomware operations against public health and other critical infrastructure sectors. [Date Occurred: -; Date Discovered: -]
Overview of AhnLab’s Response to Joint Cybersecurity Advisory Between South Korea and the United States on North Korean Ransomware · 2023-02-10
excerpt: On February 10, intelligence agencies from South Korea and the United States announced a cybersecurity advisory in regard to ransomware attacks from North Korea. It is the first joint report between the South Korean National Intelligence Service and the United States’ National Security Agency (NSA), Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency […] | attribution sentence: Title: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities Security Advisory: South Korea’s National Cyber Security Center (NCSC) Go to site United States’ Cybersecurity and Infrastructure Security Agency (CISA) Go to site Agencies from South Korea and the United States determined that the ransomware cases of Maui and H0lyGh0st, which attacked institutions in charge
북한 랜섬웨어 한미 합동 사이버보안 권고 관련 안랩 대응 현황 · 2023-02-10
excerpt: 2월 10일 오늘 한미 정보기관이 북한발 랜섬웨어 공격과 관련한 보안 권고문을 발표하였다. 대한민국 국가정보원과 미국 국가안보국(NSA)·연방수사국(FBI)·사이버인프라보안청(CISA)·보건복지부(HHS)이 함께 북한발 사이버 공격에 대한 실태를 알리고, 랜섬웨어로부터 한미 양국을 보호하기 위한 최초의 합동 보고서이다. 제목: 랜섬웨어 공격을 통한 북한의 금전 탈취 수법 보안 권고문: 대한민국 국가사이버안보센터 (NCSC) 바로가기 미국 사이버인프라보안청 (CISA) 바로가기 한미 양국은 미국 의료ㆍ공중 보건 분야 […]
Global ransomware campaign against health-care and critical infrastructure targets (Maui and H0lyGh0st) · February 2023 (advisory)
Para 144: “The Panel notes that two Member States issued an advisory in February regarding a global ransomware campaign by the Democratic People’s Republic of Korea against health-care and critical infrastructure targets. ... The advisory includes ... indicators of compromise for Maui and H0lyGh0st ransomware variants. According to the advisory, the Democratic People’s Republic of Korea has been using revenue from ransomware attacks to fund other malicious cyberoperations ...” Footnote 168: “The Democratic People’s Republic of Korea cyberthreat actor behind the ransomware attacks is referred to as Andariel.” (annex 76: “#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities”, 9 February 2023)
CISA issues alert with South Korean government about DPRK's ransomware antics · 2023-02-12T17:00:00+00:00
This alert highlights continuous state-sponsored ransomware activities by the Democratic People’s Republic of Korea (DPRK) against organizations in the US healthcare sector and