DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

2019 (140)

Date (as written)IncidentCountryActors
2019-11UpbitKorea, Republic of
2019-10Kudankulam Nuclear Power PlantIndiaLazarus
September 2019U.S.-based company hack (September 2019)United StatesThe North Korea-associated hacker
2019-09Magyar Fejlesztési KözpontHungary
2019-07MarkAnyKorea, Republic ofAndariel
2019-07BitpointJapan
2019-07CoinTigerSingapore
2019-03Bithumb#4Korea, Republic of
2019-03Kuwait BankKuwait
2019-03BiKiSingapore
2019-03CoinBeneJapan
2019-03DragonExSingaporeLazarus
2019-03Nigerian Financial InstitutionNigeria
2019-03Gambian Financial InstitutionGambia
2019-02Bank of VallettaMalta
2019-02Spanish Financial InstitutionSpain
2019-01CryptopiaNew ZealandBluenoroff
2019-12-30T20:18:41+00:00 (published_time)Thallium spear-phishing; Microsoft court order seizes 50 domainsU.S., as well as Japan and South KoreaThallium
October 2019CSIS entry 674
Sep 2019Autumn Aperture—malware embedded in antiquated file typesUnnamed U.S.-based entitiesKimusky
21/08/2019North Korea?>1?
July 2019CSIS entry 712
2019-03-27라자루스(Lazarus) 그룹, 이스라엘 군수업체 대상 APT 역습Lazarus; 라자루스
March 2019CSIS entry 747
February 2019CSIS entry 752
01.01.2019Lazarus turns against RussiaRussiaLazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
January 2019CSIS entry 760
01.09.2019Operation In(ter)ceptionEurope (region);Middle East (region)Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
01.07.2019Fractured StatueUnited StatesTA406/Konni Group/Opal Sleet fka OSMIUM < Kimsuky
October 2019AppleJeus Version 2: JMT Trading (trojanized cryptocurrency application)HIDDEN COBRA
2019-01Operation “Kabar Cobra”Kimsuky, Velvet Chollima
2019-04Operation “Stealth Power”Kimsuky, Velvet Chollima
2019-04Operation “Smoke Screen”Kimsuky, Velvet Chollima
2019-07Operation “Red Salt”Kimsuky, Velvet Chollima
August 2019Targeting of retired South Korean diplomats, government and military officialsKimsuky
2019-05Hackers associated with the APT Lazarus/HIDDEN COBRA group were found to be breaking into online stores of large US retailers and planting payment skimmers as early as May 2019.Lazarus Group, Hidden Cobra, Labyrinth Chollima
2019-09Lazarus Group’s MATA Framework Leveraged to Deploy TFlower RansomwareLazarus Group, Hidden Cobra, Labyrinth Chollima
2019-01Operation “Holiday Wiper”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-03Operation “Golden Bird”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-03Operation “High Expert”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-04Operation “Black Banner”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-09Operation “Dragon messenger”Reaper, APT 37, Ricochet Chollima, ScarCruft
11/28/2019South Korean Supply ChainsN Korea / S Korea
2019-11-07Indian Space Research Organisation (ISRO)IndiaNGB 3rd Technical Surveillance Bureau
2019-03-23Etbox
2019-06-30Bitcoin Norway (AlphaPoint)
2019-08-26Individual Serej
Nov 2019Targeting of South Korean macOS usersSouth Korean macOS usersLazarus Group; The North Korean threat actor; Lazarus Group
28 May 2019UpBit attacked. No losses reported.ROKSuspected DPRK (annex title)
July 2019Virtual currency exchange hack (July 2019)an actor tied to North Korea
since around 2019Lazarus attacks via LinkedIn against organizations in JapanJapanLazarus attack group
ongoing since 2019Operation Dangerous Password targeting crypto currency exchangersJapanLazarus attack group (operation identified in Japan and associated with Lazarus)
2019-05-13북한 해커들, 데이터 탈취를 위해 ELECTRICFISH 사용해HIDDEN COBRA; Hidden Cobra; Lazarus; 라자루스
2019-05-13T10:00:03ScarCruft continues to evolve, introduces Bluetooth harvester
2019-08-1919th August – Threat Intelligence Bulletin
2019-12-099th December – Threat Intelligence Bulletin
2019-12-11T17:00:24.000Z5 Things to Know About SentinelLabs’ Finding Link Between Crimeware and APT Lazarus | SentinelOne
17/12/2019Multiple targets>1The Lazarus Group
Beginning on or before March 6, 2019iCryptoFx malicious cryptocurrency applicationJON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB)
Beginning on April 27, 2019Fake employee personas for iCryptoFxJON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB)
December 2019AppleJeus Version 3: Union Crypto (trojanized cryptocurrency application)HIDDEN COBRA
In November 2019Spear-phishing of U.S. Department of State employeesU.S.JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB)
On or about September 19, 2019 onward; extortion demand and on or about March 9, 2022 leakU.S. Business #1, a software development company located in Oregon: IT worker hired under M.A. identity; extortion and leak of proprietary informationU.S. (Oregon)KIM YE WON; SOK KWANG HYOK; HYON CHOL SONG
From approximately September 2019 through November 2022Phagnasay, Salazar and Travis identity-lending IT worker scheme (S.D. Ga.)United Statesoverseas IT workers (DPRK scheme)
in 2019 and 2020Hundreds of MID-subordinate IT workers in China (UN Panel, cited in annex)ChinaMunitions Industry Department (MID)
10/04/2019Multiple Targets>1Lazarus Group (AKA Hidden Cobra)
05/08/2019Banks and cryptocurrency exchanges>1North Korea
09/09/2019Targets in the USUS?
23/09/2019Research Centers in IndiaINAttackers from North Korea
12/10/2019Mac owners working at cryptocurrency exchanges>1Attackers from North Korea
31/10/2019Multiple targets in the USUSHidden Cobra AKA Lazarus Group
03/12/2019macOS users>1Lazarus Group
2019-10-24라자루스(Lazarus)그룹, 미국 라스베가스 CES2020 참관단 참가신청서 사칭 APT 공격 정황 포착Lazarus; 라자루스
2019-08-24코니(Konni) APT 조직, 안드로이드 스파이 활동과 김수키 조직 유사성 분석KONNI; Kimsuky; Konni; 김수키; 코니
2019-08-05금성121 APT 조직, 스테가노그래피 기법과 스마트폰 노린 퓨전 공격 수행Geumseong121; 금성121
2019-08-03금성121 조직, 라자루스로 위장한 APT '이미테이션 게임' 등장Geumseong121; Lazarus; 금성121; 라자루스
2019-07-02암호화폐 거래자를 노린 Lazarus APT 공격 가속화Geumseong121; Kimsuky; Lazarus; 금성121; 김수키; 라자루스
2019-07-02금성121 APT 조직, 안보통일관련 소식으로 스피어피싱 공격 시도Geumseong121; 금성121
2019-06-20라자루스(Lazarus) APT 그룹, 암호화폐 투자계약서 사칭 무비 코인 작전Lazarus; 라자루스
2019-06-15'금성121' 조직, 북한 선교 학교 신청서 사칭으로 APT 공격Geumseong121; 금성121
2019-05-20김수키 조직, 한국을 겨냥한 '페이크 스트라이커' APT 작전 개시Fake Striker; Kimsuky; 김수키; 스모크 스크린; 페이크 스트라이커
2019-06-27라자루스(Lazarus) APT 조직, 텔레그램 메신저로 '진실겜.xls' 악성 파일 공격Lazarus; 라자루스
2019-01-31라자루스 APT 조직, 오퍼레이션 익스트림 잡(Operation Extreme Job)으로 공격 수행Lazarus; 라자루스
2019-12-04김수키 조직, 청와대 녹지원/상춘재 행사 견적서 사칭 APT 공격Kimsuky; 김수키; 블루 에스티메이트
2019-10-17김수키(Kimsuky) 조직 소행 추정 ‘대북 분야 국책연구기관’ 사칭 스피어피싱 공격 발견Kimsuky; 김수키
2019-10-01코니(Konni) APT 조직, HWP 취약점을 이용한 'Coin Plan' 작전 감행KONNI; Kimsuky; Konni; 김수키; 코니
2019-09-27북한 파일명으로 보고된 Kimsuky 조직의 '스모크 스크린' PART 3Kimsuky; Smoke Screen; 김수키; 스모크 스크린
2019-09-27코니(Konni) APT 그룹, 러시아-북한-한국 무역, 경제관계 투자문서로 공격 수행KONNI; Konni; 코니
2019-03-21김수키 조직, 워터링 홀 개시 '오퍼레이션 로우 킥(Operation Low Kick)'Kimsuky; 김수키
2019-03-07목소리 음성파일을 재생하는 김수키 APT 공격 '오퍼레이션 블랙햇 보이스(Operation Blackhat Voice)'Kimsuky; 김수키
2019-02-21김수키(Kimsuky) 2차 북미정상회담 좌담회 사칭 APT 공격, '작전명 라운드 테이블'Kimsuky; 김수키
2019-05-28김수키 조직, 사이버 안전국 암호화폐 민원안내로 사칭해 APT 공격 수행Kimsuky; 김수키; 스모크 스크린; 페이크 스트라이커
2019-05-28김수키 조직, 한국 암호화폐 거래소 이벤트 사칭 APT 공격 발생Kimsuky; 김수키; 페이크 스트라이커
2019-05-13암호화된 APT 공격, Kimsuky 조직의 '스모크 스크린' PART 2Kimsuky; 스모크 스크린
2019-05-02금성121 조직, 학술회의 안내로 위장한 '프린팅 페이퍼' APT 공격 시도Geumseong121; 금성121
2019-08-30라자루스(Lazarus), 사회공학적 기법으로 당신의 비트코인을 노린다!Lazarus; 라자루스
2019-08-20라자루스(Lazarus), 소명자료요구서로 위장한 '무비 코인' 캠페인 지속Lazarus; 라자루스
2019-07-19암호화폐 거래소 회원 겨냥한 무비코인 작전 지속… 배후에 ‘라자루스’ 조직Lazarus; 라자루스
2019-07-15라자루스(Lazarus) APT 그룹, 신상명세서 문서로 위장한 공격 수행Lazarus; 라자루스
2019-07-12라자루스, 시스템 포팅 명세서 사칭한 APT작전 '무비 코인' 으로 재등장Lazarus; 라자루스
2019-08-19코니(Konni) APT 조직, 러시아 문서로 위장한 공격 등장KONNI; Kimsuky; Konni; 코니
2019-06-27비트코인 1,500만원 돌파하면서 김수키(Kimsuky) APT 공격 중Kimsuky; 김수키
2019-06-10[스페셜 리포트] APT 캠페인 'Konni' & 'Thallium(Kimsuky)' 조직의 공통점 발견KONNI; Kimsuky; Konni; Thallium; 김수키; 코니; 탈륨
2019-04-22'금성121 조직', 통일부를 사칭한 APT 공격, 구글 드라이브로 악성코드 전파Geumseong121; 금성121
2019-01-10'남북경협 자문용 질문'으로 위장한 최신 APT 공격 등장Kimsuky; 김수키
2019-01-02암호화폐 내용의 Konni APT 캠페인과 '오퍼레이션 헌터 아도니스'KONNI; Konni
2019-12-12코니(Konni) 조직, 병원관련 소송 답변 문서로 위장한 APT 공격 수행KONNI; Konni; 코니
2019-05-16한국어 구사 Konni 조직, 블루 스카이 작전 'Amadey' 러시아 봇넷 활용KONNI; Konni
2019-09-19Operation Moneyholic With HWP DocumentKONNI; Konni; 코니
2019-11-18포털 사이트의 보안 프로그램으로 위장한 악성코드 주의Kimsuky; 김수키
2019-01-31방글라데시 정부, 중앙은행 해킹 사건으로 필리핀 은행 고소라자루스
2019-08-12[정보보호 20년史] 2013년: 3.20 및 6.25 사이버테러 발발
2019-11-25국가지원 해커 조직, 백신 우회하는 한글문서 공격Kimsuky; 김수키
2019-09-14미 재무부, 북한 해킹그룹 3곳 제재...'라자루스' 등 대상라자루스; 안다리엘; 블루노로프
August 2019Spearphishing targeted at five permanent missions of UN Security Council member countries (ANSSI report)China; France; Belgium; Peru; South Africa (permanent missions)Kimsuky and Group123 (technical links per ANSSI)
October 2019 - March 2022‘DeathNote’ campaign (also referred to as ‘Operation Dream Job’)Lazarus Group
since about 2019TA408 custom malware campaigns against aerospace, defense, engineering and pharmaceutical sectors and U.S. and ROK military targetsTA408 (also known as Cerium)
mid-2019 to mid-2024SANS FAB/Sangsin IT delegation earnings via U.S. online payment service providersLaosSANS FAB / Sangsin IT delegation (lead likely Pak Chol-yong)
2019-11-29T10:00:12IT threat evolution Q3 2019
2019-04-30APT trends report Q1 2019 (DPRK-related paragraph 1)
2019-05-23IT threat evolution Q1 2019 (DPRK-related paragraph 1)
2019-05-23IT threat evolution Q1 2019 (DPRK-related paragraph 2)
2019-08-01APT trends report Q2 2019 (DPRK-related paragraph 1)
2019-08-01APT trends report Q2 2019 (DPRK-related paragraph 2)
2019-08-01APT trends report Q2 2019 (DPRK-related paragraph 3)
2019-08-19IT threat evolution Q2 2019 (DPRK-related paragraph 1)
2019-08-19IT threat evolution Q2 2019 (DPRK-related paragraph 2)
2019-08-19IT threat evolution Q2 2019 (DPRK-related paragraph 3)
2019-08-19IT threat evolution Q2 2019 (DPRK-related paragraph 4)
2019-10-16APT trends report Q3 2019 (DPRK-related paragraph 1)
2019-10-16APT trends report Q3 2019 (DPRK-related paragraph 2)
2019-11-29IT threat evolution Q3 2019 (DPRK-related paragraph 1)
2019-12-04APT review: what the world’s threat actors got up to in 2019 (DPRK-related paragraph 1)
2019-12-04APT review: what the world’s threat actors got up to in 2019 (DPRK-related paragraph 2)
2019-12-04APT review: what the world’s threat actors got up to in 2019 (DPRK-related paragraph 3)
2019-12-04APT review: what the world’s threat actors got up to in 2019 (DPRK-related paragraph 4)
2019-04-25T18:28:33.000ZLazarus APT Targets Mac Users with Poisoned Word Document - SentinelLabs
2019-10-23T07:00:00.000ZA Deep-Dive Analysis of the NukeSped RATs
2019-11-20Mac Backdoor Linked to Lazarus Targets Korean Users
2019-12-23T15:01:52.000Z穷源溯流：KONNI APT组织伪装韩国Android聊天应用的攻击活动剖析