UN Panel of Experts S/2024/215
Compromise of the email server and internal network of NPO Mashinostroyenia · likely between late 2021 and May 2022
Para 133: “The Democratic People’s Republic of Korea cyberactor groups ScarCruft and the Lazarus Group compromised the email server and internal network of NPO Mashinostroyenia in separate intrusions, likely between late 2021 and May 2022. The Russian Federation replied: “There has been no evidence found on cyberattacks on the internal [information technology] infrastructure of the Russia organization, NPO Mashinostroyenia by a cyber threat actor linked to the [United Nations]-designated [RGB (KPe.031)] of the DPRK, the Lazarus Group, ScarCruft or Kimsuky”.” Para 141: infrastructure used by ScarCruft in this attack “had also been used by other Democratic People’s Republic of Korea cyberactors, including Kimsuky.”