US Sanctions Against N. Korean Hacking Groups

The United States Treasury Department recently announced sanctions against three state-sponsored North Korean hacking groups that have been cyberattacking some US critical infrastructureThese hacking groups have also been accused of stealing possibly hundreds of millions of dollars from financial institutions around the world in order to fund the North Korean illicit weapons and missile programs. 

The three North Korean hacking groups in question are the well-known Lazarus Group, and its two sub-groups, Bluenoroff and Andariel.

The sanctions announced by the Treasury Department's Office of Foreign Assets Control (OFAC) claim that all the three groups are "agencies, instrumentalities, or controlled entities of the Government of North Korea" based on their relationship with Pyongyang's central intelligence bureau called the Reconnaissance General Bureau (RGB).

Specifically, the sanctions aim to lock any foreign financial institution who knowingly facilitated significant transactions or services for these hacking groups and freeze any asset associated with these three groups.

Hidden Cobra
The well-known group out of all is Lazarus Group, also known as Hidden Cobra and Guardians of Peace, that has allegedly been associated with several high-profile cyber-attacks, including Sony Pictures hack in 2014 and the WannaCry attack in 2017.

According to the Treasury's OFAC, the WannaCry attack hit several organizations in at least 150 countries, including the United States, Australia, Canada, New Zealand, and the United Kingdom, and shut down about 300,000 computers.
However, the fatal Wannacry hit was against the UK's National Health Service (NHS), with hospitals that provide intensive care units and other emergency services virtually shut down and over 19,000 appointments canceled, which cost the NHS more than $112 million.

The US Department of Justice last year also announced criminal charges against a N. Korean computer programmer, named Park Jin Hyok, in connection with the WannaCry ransomware attacks and Sony Pictures hack.

Bluenoroff
According to the Treasury Department, the Lazarus group formed its first sub-group, called Bluenoroff, specifically to obtain revenue for the North Korean government by targeting financial institutions around the world.

Since at least 2014, Bluenoroff had targeted the Society for Worldwide Interbank Financial Telecommunication (SWIFT), financial institutions, and cryptocurrency exchanges, using a variety of tactics like phishing and backdoor intrusions.
The group had successfully carried out such operations against over 16 organisations across 11 countries, including Bangladesh, India, Mexico, Pakistan, Philippines, South Korea, Taiwan, Turkey, Chile, and Vietnam.

Bluenoroff's most notorious cyber-attack involving SWIFT being against the Central Bank of Bangladesh's New York Federal Reserve in 2016, when the group worked with Lazarus Group to take $81m from the Reserve account, while it attempted to steal $851m. 

Anadriel 
The second Lazarus Group sub-group, Andariel, has been specialised in conducting malicious cyber operations against foreign businesses, government agencies, financial services, private corporations, and the defense industry. 

Andariel was "observed by cyber-security firms attempting to steal bank card information by hacking into ATMs to withdraw cash or steal customer information to later sell on the black market," the Treasury said.The Treasury also said Andariel hackers created unique malware to hack online poker and gambling sites to steal cash. However, besides its criminal activities, Andariel continues to conduct cyber-attacks against South Korea government personnel and the South Korean military in an effort to gather intelligence and create disorder.

"One case spotted in September 2016 was a cyber intrusion into the personal computer of the South Korean Defense Minister in the office at that time and the Defense Ministry's intranet in order to extract military operations intelligence," the US Treasury said.

In addition, these three state-sponsored hacking groups likely managed to steal around $571 million in cryptocurrency alone, from at least five cryptocurrency exchanges in Asia between January 2017 and September 2018. 

The sanctioning of the three groups are the latest efforts of the US government to hold North Korean hackers accountable for cyber-attacks and to protect US financial systems and critical infrastructure against cyber-threats.

The Hacker News

You Might Also Read:

America Remains Vulnerable To Cyber Attack:

N. Korea Employs Grads For Cyber Warfare:

 

 

« Will Robots Be Allowed To Kill?
AI Is Changing The Cyber Security Landscape »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

GigaOm

GigaOm

GigaOm's mission is to provide enterprises with information and analysis to help them make better decisions about technology.

International Association of Professional Security Consultants (IAPSC)

International Association of Professional Security Consultants (IAPSC)

Members of the IAPSC represent a unique group of respected, ethical and competent security consultants.

Security Audit Systems

Security Audit Systems

Security Audit Systems is a website security specialist providing website security audits and managed web security services.

AdNovum Informatik

AdNovum Informatik

AdNovum Informatik provides a full set of IT services, ranging from consulting, the conception and implementation of customized business and security solutions to maintenance and support.

Guy Carpenter

Guy Carpenter

Guy Carpenter delivers a powerful combination of broking expertise, strategic advisory services, and industry-leading analytics.

Dubai Electronic Security Center (DESC)

Dubai Electronic Security Center (DESC)

Dubai Electronic Security Center (DESC) was founded to develop and implement information security practices in Dubai.

AnubisNetworks

AnubisNetworks

AnubisNetworks is one of Europe’s leading threat intelligence and email security suppliers.

Sapien Cyber

Sapien Cyber

Sapien Cyber is an Australian company bringing leading-edge cyber security and threat intelligence solutions.

MedCrypt

MedCrypt

MedCrypt are a team of medical device experts focused on bringing modern cybersecurity features to the next generation of healthcare technology.

Vector Informatik

Vector Informatik

Vector Informatik is a specialist in automotove electronics and provides services, embedded software and tools for securing embedded systems against cyber-attacks.

Field Effect Software

Field Effect Software

Field Effect Software build sophisticated and integrated IT security, threat surface reduction, training and simulation capabilities for enterprises and small businesses.

Key Cyber Solutions

Key Cyber Solutions

Key Cyber is an IT consulting firm that specializes in agile software development services, program management and infrastructure services, cyber security and cloud and managed services.

Schweitzer Engineering Laboratories (SEL)

Schweitzer Engineering Laboratories (SEL)

SEL specializes in creating digital products and systems that protect, control, and automate power systems around the world.

Nassec

Nassec

Nassec is a Cyber Security firm dedicated to providing the best vulnerability management solutions. We offer tailor-made cyber security solutions based upon your requirements and nature of business.

Wazuh

Wazuh

Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance.

Clearnetwork

Clearnetwork

Clearnetwork specializes in managed cybersecurity solutions that enable both public and private organizations improve their security posture affordably.