Targeting of journalists reporting on North Korea

Date (as written): Apr 2022
Year: 2022
Country: Journalists and the former director of South Korea’s National Intelligence Service
Actors (as written): APT 37
Actor pages: APT 37
Tags (as written): Espionage; Civil society

Source entries (2)

CFR Cyber Operations Tracker

Targeting of journalists reporting on North Korea · Apr 2022

North Korea–linked threat actor APT 37 targeted journalists with novel Goldbackdoor malware. APT 37 initially used RokRat malware to hack the email account of a former director at South Korea’s National Intelligence Service. The hackers then impersonated the official and targeted South Korean journalists, sending emails laced with Goldbackdoor malware. The malware can be used to steal passwords and documents.

https://www.cfr.org/cyber-operations/targeting-of-journalists-reporting-on-north-korea

https://stairwell.com/news/threat-research-the-ink-stained-trail-of-goldbackdoor/

https://www.nknews.org/2022/04/north-korean-hackers-steal-ex-intelligence-officials-emails-in-malware-attack/

Check Point Research

2nd May – Threat Intelligence Report · 2022-05-02

North Korean government connected group initiated in March 2022 a spear-phishing campaign against journalists who specialize in the North Korea coverage. The group used Goldbackdoor malware that is linked to malware families that are attributed to APT37.

https://research.checkpoint.com/2022/2nd-may-threat-intelligence-report/

Suggest a correction on GitHub