UK NCSC news: UK and Republic of Korea issue warning about DPRK state-linked cyber actors attacking software supply chains
DPRK state-linked software supply chain attacks using zero-day vulnerabilities (NCSC-NIS joint advisory) · (published 23 November 2023)
Cyber actors linked to the Democratic People's Republic of Korea (DPRK) are increasingly targeting software supply chain products to attack organisations around the world, the UK and the Republic of Korea have warned today (Thursday). In a new joint advisory , the National Cyber Security Centre (NCSC) - a part of GCHQ - and the National Intelligence Service (NIS) have detailed how DPRK state-linked cyber actors have been using increasingly sophisticated techniques to gain access to victims' systems. The actors have been observed leveraging zero-day vulnerabilities and exploits in third-party software to gain access to specific targets or indiscriminate organisations via their supply chains. The NCSC and the NIS consider these supply chain attacks to align and considerably help fulfil wider DPRK-state priorities, including revenue generation, espionage and the theft of advanced technologies.