North Korea (aka DPRK, The Democratic People’s Republic of Korea) is an escalating cyber threat to the international community, network defenders and the public, a recent advisory issued by the U.S. Departments of State, Treasury and Homeland Security through the Cybersecurity Infrastructure Security Agency, warned.
“DPRK’s malicious cyber activities threaten the United States and the broader international community and, in particular, pose a significant threat to the integrity and stability of the international financial system,” the alert (Guidance on the North Korean Cyber Threat), which also provides recommended steps to mitigate the threat, reads.
In the U.S. government’s assessment, North Korea is capable of disrupting the nation’s critical infrastructure and stealing from financial institutions and has “demonstrated a pattern of disruptive and harmful cyber activity that is wholly inconsistent with the growing international consensus on what constitutes responsible State behavior in cyberspace,” the warning reads. In other words, the rogue nation has gone rogue in cyberspace.
DPRK state-sponsored cyber actors primarily consist of hackers, cryptologists, and software developers who conduct espionage, cyber-enabled theft targeting financial institutions and digital currency exchanges, and politically-motivated operations against foreign media companies, the CISA note said. Oft-used tactics include:
Cyber-enabled financial theft and money laundering. As of 2019, the DPRK has attempted to steal as much as $2 billion through these illicit cyber activities.
Extortion campaigns. DPRK cyber actors have also conducted extortion campaigns against third-country entities by compromising an entity’s network and threatening to shut it down unless the entity pays a ransom.
Cryptojacking. Hackers have conducted several campaigns in which computers infected with cryptojacking malware sent the mined assets--much of it anonymity-enhanced digital currency -- to servers located in the DPRK.
Cyber operations publicly attributed to DPRK by the U.S. government. DPRK state-sponsored cyber actors and co-conspirators are responsible for the Sony hack in 2014 to steal confidential information; the Bangladesh bank heist in 2016 that netted DPRK bad actors some $81 million; the WannaCry 2.0 cyber contagion in May 2017; the FastCash fraudulent ATM withdrawal scheme used to steal tens of millions of dollars in Asia and Africa; an April 2018 hack into a digital currency exchange to steal $250 million worth of digital currency, and others.
According to the departments of State, Treasury and Homeland Security, a mitigation strategy for governments, industry, civil society and individuals to protect themselves and counter the DPRK cyber threat needs to include:
“To hamper the DPRK’s efforts to steal funds through cyber means and to defend against the DPRK’s malicious cyber activities, the United States strongly urges countries to strengthen network defense, shutter DPRK joint ventures in third countries, and expel foreign-located North Korean information technology workers in a manner consistent with applicable international law,” the advisory said.
It also includes a warning: “Individuals and entities engaged in or supporting DPRK cyber-related activity, including processing related financial transactions, should be aware of the potential consequences of engaging in prohibited or sanctionable conduct.”
