Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025
Supply chain attack via a DLP software update server against ROK aerospace and shipbuilding defense companies · May 2024
(MSMT/2025/2, report p. 93-94) “In May 2024, Andariel launched malicious cyber operations against ROK companies in the defense industry, in particular those related to aerospace and shipbuilding. To conduct the cyber operation, Andariel targeted vulnerabilities in the software supply chain to access the central update server of a data loss prevention (DLP) software developed by a cybersecurity company ... This cyber operation resulted in Andariel extracting large amounts of technical data including weapons design from servers and computers of various defense technology companies.”