Ransomware-funded data exfiltration from NASA, U.S. Air Force, defense companies, a Chinese energy company, a Taiwan-based defense company and two ROK defense companies

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

(MSMT/2025/2, report p. 94) “One notable instance of North Korea’s unique cyber toolset was revealed to the public in October 2024. DPRK actor Rim Jong Hyok, a member of the Reconnaissance General Bureau (RGB), and RGB co-conspirators targeted hospitals and healthcare companies with malware which encrypted victim devices ... The revenue generated from the ransomware payments funded the purchase of infrastructure including virtual private servers subsequently used to exfiltrate data from the U.S. National Aeronautics and Space Administration (NASA), a California-based defense contractor that builds satellites, a Michigan-based defense company that builds military equipment, the United States Air Force, a Massachusetts-based defense company that builds aircraft, a Chinese energy company, a Taiwan-based defense company, and two ROK defense companies.” (footnotes cite DOJ, July 25, 2024 and indictment July 24, 2024)