Cyber Espionage Initiative Supported by North Korean Operatives Aims at Britain's Armed Forces

North Korean state-backed cyber actors have launched a campaign targeting nuclear materials, military drones, submarines, shipbuilding in the UK and US, as well as sensitive industries. Intelligence agencies have issued a warning about a "global cyber-espionage campaign" aimed at these sectors.

A joint statement from the US, UK, and South Korea has revealed that the Democratic People's Republic of Korea (DPRK) is deploying state-backed attackers to further its military and nuclear ambitions. Japan and India have also been impacted by this campaign.

The hackers in question operate under a group called Andariel, which has targeted sensitive information related to the nuclear industry, defense sector, aerospace, engineering, medical, and energy sectors.

Paul Chichester, director of operations at the National Cyber Security Centre (NCSC), commented on this issue, emphasizing that it demonstrates the extent DPRK's state-sponsored groups will go to support their military and nuclear programs.

According to the NCSC, Andariel compromises organizations worldwide to steal sensitive and classified technical information and intellectual property data. They believe this group is part of DPRK’s reconnaissance general bureau (RGB) and pose a threat to critical infrastructure globally.

The hackers have targeted the following: tanks, torpedoes, fighter aircraft, satellites, government nuclear facilities, nuclear power plants, robots, and 3D printing technology. The NCSC has reported that Andariel funds its espionage operations through ransomware attacks on the US healthcare sector using publicly available internet scanning tools.

NCSC director of operations, Paul Chichester, urges critical infrastructure operators to protect sensitive information and intellectual property from theft and misuse by following guidance provided in this advisory.

The recent advisory highlights Andariel's evolution from destructive hacking attacks against US and South Korea organizations to specialized cyber espionage and ransomware activities. In some instances, they have carried out both types of attacks on the same day against a single target.

In response to this threat, the US state department has offered a reward of up to $10 million for information leading to Rim Jong Hyok's arrest and conviction. He is believed to be associated with Andariel and was involved in ransomware attacks on US hospitals to fund cyber operations against government bodies and defense firms.

According to law enforcement agencies, the group targeted five healthcare providers, four US defense contractors, two US air force bases, and NASA's office of inspector general. In one attack that started in November 2022, hackers extracted over 30 gigabytes of data from a US defense contractor, including unclassified technical information about military aircraft and satellites.

North Korea's motivations in cyber warfare appear to be two-fold: national security goals for conventional military purposes and financial gain through illicit activities. A UN report states that Korean hackers have been involved in almost 60 attacks on cryptocurrency-related companies over the past six years, stealing an estimated $3 billion. The largest attack against crypto exchange Poloniex alone resulted in a loss of more than $110 million.

The UN report concludes that cyber threat actors' key tasks are to obtain information valuable to DPRK and generate revenue for the country through various means, including phishing, exploiting vulnerabilities, social engineering, and watering hole attacks.