Government organizations, academics, and think tanks in the United States, Europe, Japan, and South Korea for the past five years. · 28/03/2023
Researchers from Mandiant disclose the details of APT43, a new North Korean group, financially motivated and engaged in cyber espionage operations, targeting government organizations, academics, and think tanks in the United States, Europe, Japan, and South Korea for the past five years. [Date Occurred: Since late 2018; Date Discovered: -]
APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations · March
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 7 of 75, PDF p. 320). DPRK cyber actor: ScarCruft; Report Name: APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations; Case Summary: ScarCruft has been observed using tools previously associated with other subordinate adversarial syndicates within RGB, such as the Lazarus Group. Attack chains mounted by ScarCruft involve spear -phishing emails containing tailored lures to entice victims. These messages are sent using spoofed and fraudulent personas that masquerade as key individuals within the target's area of expertise to gain their trust. ScarCruft also takes advantage of contact lists stolen from compromised individuals to identify more targets and steal cryptocurrency to fund its attack infrastructure. The stolen digital assets are then laundered using hash rental and cloud mining services to obscure the forensic trail and convert them into clean cryptocurrency.; Publication Month: March
apt43-north-korea-cybercrime-espionage · March
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 13 of 75, PDF p. 321). DPRK cyber actor: Kimsuky; Report Name: apt43-north-korea-cybercrime-espionage; Case Summary: Kimsuky carried out spear -phishing attacks containing tailored lures to entice victim, using spoofed and fraudulent personas that masquerade as key individuals withing the target’s areas of expertise to gain their trust. Kimsuky also took advantage of contact lists stolen from compromised individuals to identify more targets and steal cryptocurrency to fund its attack infrastructure. The stolen digital assets are then laundered using hash rental and cloud mining services to obscure the forensic trail and convert them into clean cryptocurrency.; Publication Month: March
APT43 espionage and cryptocurrency theft to fund operations · 2023-03-28 (datePublished)
Targeting: Espionage targeting is regionally focused on South Korea, Japan, Europe, and the United States, especially in the following sectors: government, business services, and manufacturing, along with education, research, and think tanks focused on geopolitical and nuclear policy. The group shifted focus to health-related verticals throughout the majority of 2021 ... Activity: APT43 steals and launders enough cryptocurrency to buy operational infrastructure