North Korea Is Upping Its Offensive Cyber Operations

North Korean offensive cyber activity — everything from spying on journalists to cryptocurrency heists — has been trending up, cybersecurity researchers say.

On Tuesday, network security researchers FireEye put out a report revealing a new hacker group called Reaper or APT37. Calling them “the overlooked North Korean actor,” the report says “the group’s operations are expanding in scope and sophistication, with a toolset that includes access to zero-day vulnerabilities and wiper malware.”

What’s wiper malware? The public got its first real introduction in 2014, during the Sony Pictures hack, when people linked to the North Korean regime used it to steal data from Sony Pictures and then delete it from the studio’s hard drives. It’s one reason that James Clapper, then the director of the Office of National Intelligence, called the Sony hack “the most serious” cyber attack ever against a U.S. entity. It was also particularly brazen.  

FireEye says that APT37 doesn’t appear to be as bold and aggressive as the perpetrators of the Sony hack. Reaper’s primary mission is closer to intelligence-gathering. Founded in 2014, they’ve hit mostly South Korean targets, including the military and the government but also the industrial base and the media. Last April, they hit a Middle Eastern company doing business with the North after what the report calls “a business deal that went bad.”

They’ve also hit academics, think-tank workers and journalists studying and writing about human rights abuses.

But APT 37 isn’t the only North Korean player that’s getting busier.

Last November, shortly after 24-year-old North Korean soldier Oh Chung-sung made it across the border, several defectors and South Korean journalists began to receive highly suspicious emails carrying links to sites loaded with malware.

Journalists with Free Asian Radio and several other South Korean news outlets began to report suspicious outreach suspicious outreach from someone via a popular South Korean chatting app called KakaoTalk.

A Jan. 15 report by cybersecurity company McAfee found hints that that North Koreans were to blame.

“This malware campaign is highly targeted, using social network services and KakaoTalk to directly approach targets and implant spyware. We cannot confirm who is behind this campaign, and the possible actor Sun Team is not related to any previously known cybercrime groups. The actors are familiar with South Korea and appear to want to spy on North Korean defectors, and on groups and individuals who help defectors,” McAfee wrote.

Also on Tuesday, NBC reporter Ken Dilanian revealed details about a new actor called Labyrinth Chollima. The group, he said, was able to breach air-gapped networks. CrowdStrike, who discovered the group, wrote that its primary targets include “government, military, defense, finance, energy and electric utility sectors.”  

North Korean hackers have also been heavily targeting South Korean cryptocurrency exchanges since the fall, with the most recent attack occurring at the end of January.

Where is all of this heading? Recent reports indicate that the North’s “slush fund” for nuclear weapons testing and development has dried up. So ransomware attacks and raids against cryptocurrency exchanges will likely continue, or even accelerate.