Active North Korean campaign targeting security researchers

UN Panel of Experts S/2024/215

Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 36 of 75, PDF p. 325). DPRK cyber actor: DPRK cyber actors; Report Name: Active North Korean campaign targeting security researchers; Case Summary: In January 2021, a DPRK cyber actor campaign was publicly disclosed, in which they used 0-day exploits to target security researchers working on vulnerability research and development. Over the past two and a half years, the campaign has continued. Recently, DPRK cyber actors were found to likely be responsible for a new, similar campaign, with at least one actively exploited 0-day being used to target security researchers in the past several weeks. DPRK threat actors used social media sites like X (formerly Twitter) to build rapport with their targets. After initial contact via X, they moved to an encrypted messaging app such as Signal, WhatsApp or Wire. Once a relationship was developed with a targeted researcher, the threat actors sent a malicious file that contained at least one 0-day in a popular software package. Upon successful exploitation, the shellcode conducts a series of anti-virtual machine checks and then sends the collected information, along with a screenshot, back to an attacker -controlled command and control domain. The shell code used in this exploit is constructed in a similar manner to shellcode observed in previous North Korean exploits.; Publication Month: September