Month: April 2023

A criminal cyber spy group believed to be backed by the North Korean government poses as journalists, academics and experts to trick its victims into giving out information that can be used for espionage. It also spoofs websites of legitimate organizations to trick targets into giving out information that can be used in cybercrimes the group carries out to fund itself, according to a new report that tracked the cyber attackers’ operations over five years. Google Cloud’s cybersecurity subsidiary firm Mandiant classified the group, which it calls APT43 and which it has been monitoring since 2018, as a “moderately-sophisticated cyber operator that supports the interests of the North Korean regime.”  The designation of the group as a “named threat actor” indicates that Mandiant’s cyber analysts had enough evidence to attribute activity to a specific group. APT stands for “advanced persistent threats,” which the firm says are groups that “receive direction and support from an established nation state.” APT43 has also been called “Kimsuky” or “Thallium” by other firms, which have their own naming conventions. Mandiant believes the firm could be part of North Korea’s main foreign intelligence agency. “APT43 has demonstrated it can be quite fluid at adapting to the needs of the regime and shifts their targeting accordingly,”  Gary Freas, a senior analyst at Mandiant, told RFA. According to the report, APT43 conducted espionage against South Korean and U.S.-based government organizations, members of academia and think tanks that deal with North Korean geopolitical issues, and engaged in cyber crime to steal and launder crypto currency. Impersonating experts APT43’s most common attack involves impersonating experts or journalists in spear-phishing emails with the goal of getting information out of its victims.  In this scheme, the attacker poses as a reporter or a think tank analyst to collect intelligence, including by asking experts and academics to answer questions on topics related to North Korea. Often the attackers pretend to be people who are well known in their field to develop rapport with others in the field before asking them to provide strategic analysis on specific subjects. People watch a TV broadcasting a news report on North Korea firing a ballistic missile over Japan, at a railway station in Seoul, South Korea, October 4, 2022. Credit: Reuters In a sample example provided in the report, an attacker pretended to be a journalist with an email address ending in “@voanews.live,” which is similar to the “@voanews.com” addresses used by journalists working for U.S news outlet Voice of America.   The email requested a reaction to an Oct. 4, 2022, North Korean ballistic missile launch that flew over Japan, including asking the recipient if it meant that another North Korean nuclear test could be imminent, and if Japan might increase its defense budget or pursue a more “proactive” defense policy. Because the focus of these types of attacks is often North Korean security and nuclear development, Mandiant believes “with moderate confidence” that APT43 operates under the Reconnaissance General Bureau, or RGB, North Korea’s main foreign intelligence service. “Campaigns attributed to APT43 are closely aligned with state interests and correlate strongly with geopolitical developments that affect Kim Jong-un and the hermit state’s ruling elite,” the report said. “Since Mandiant has been tracking APT43, they have consistently conducted espionage activity against South Korean and U.S.organizations with a stake in security issues affecting the Korean peninsula.” Mandiant also noted that it detected a shift in the group’s activity between October 2020 and October 2021 toward targeting the health care sector and pharmaceutical companies, likely to gather information to support a North Korean response to COVID-19. This indicates that the group adapts to changing priorities of the North Korean government. “The kinds of questions we’re seeing them ask when they commission papers and when they ask for interviews are very much about potential responses to different stimuli,” Jenny Town, director of the Washington-based Stimson Center’s 38 North Project, during a discussion about APT43 in a podcast hosted by Mandiant.  “And really, [they’re] trying to better understand how different actions might be perceived, presumably to help them better decide where red lines are,” she said. Emails indicate objectives Town, who has herself been targeted by APT43 and impersonated by them when they target others, said that the emails can show what North Korea’s goals might be. “The questions they’re asking make a lot of sense and give us a sense of the kinds of things they might be thinking of doing as well,” she said. “It’s always been really interesting to see the evolution and what they’ll ask different people.” Freas said that the questions in the emails often show North Korea’s intent. “Whenever APT43 goes after people, pretending to be a reporter or prominent analyst, they ask questions that are so specific to the regime’s priority intelligence requirements that they show us their hand,” he said. “This gives us good insight into what’s going on in the closed off nation and that data is very insightful to security vendors and for people that are trying to investigate this.”  Town said that other experts have come to consider it an indication of their success in the field when they are impersonated by what seems to be North Korean cyber attackers.  APT43 has also been known to target organizations for information about sanctions items that are banned for export to North Korea, the report said. During the same podcast, Mandiant analyst Michael Barnhart said that APT43’s methods tend to work on older victims. “Some of the younger folk aren’t so [eager] to click on a suspicious link, and so you might not get them quite there,” said Barnhart. “You’re looking at kind of an older crowd that probably has a little less cyber hygiene.” ‘Good at what they do’ “What this group lacks in sophistication they make up for in volume,” said Freas. “It is unique to see the success they are having with such widely known and frequently leveraged techniques.” Freas explained that APT43 extensively researches people they can spoof…