The Weight of North Korea’s State-Sponsored APTs: Organizing and Aligning for Cyber Espionage

The Growing Agility and Complexity of North Korean Advanced Persistent Threat (APT) Groups

Increased Coordination During COVID-19 Pandemic

Since the beginning of the COVID-19 pandemic, North Korean APT groups have exhibited an unprecedented level of collaboration and coordination, according to a report published by Mandiant on October 10th. Historically, researchers have tracked North Korea’s threat activities as being carried out by individual groups, such as Lazarus Group and Kimsuky. However, these lines are beginning to blur as individual APTs increasingly coordinate efforts and share tools and information.

This increased coordination has made it more difficult for investigators to attribute specific threat activities to a particular group. North Korean actors are adapting and diversifying their attacks, developing tailored malware for different platforms, including Linux and MacOS. This flexibility in tasking allows the APT groups to stealthily move with greater speed and adaptability, making it challenging for defenders to track, attribute, and thwart their malicious activities.

Supply Chain Risks and Diversification of Attacks

The researchers at Mandiant have also identified an increasingly aggressive and broader intrusion approach by North Korean APTs, which encompasses multiple intrusions into multiple networks, using various supply chain vectors. The evolving nature of these APT groups poses an increased risk to the supply chain as they continue to diversify their attacks.

While the threat landscape is becoming more collaborative, individual APT groups continue to work on separate efforts unrelated to each other. These efforts range from ransomware attacks to collecting information on conventional weapons, nuclear entities, blockchain, fintech, and more. One of their broad goals is to steal cryptocurrency to fund the regime of North Korea’s Supreme Leader, Kim Jong Un.

A More Organized State-Sponsored Structure

The report by Mandiant provides a comprehensive structure of the current North Korean APT landscape, aiming to help defenders understand the complex network of threat groups. Ultimately, all threat groups lead back to Kim Jong Un, either providing funding or intelligence for the regime — or both.

The General Staff Department of the Korean People’s Army, which oversees the Reconnaissance General Bureau (RGB), and the Minister of State Security are two key entities directly reporting to Kim Jong Un. Several threat groups are aligned with North Korea’s RGB, including Kimsuky (APT43), Lazarus Group (APT38), Temp.HERMIT (also part of Lazarus’ activities and dedicated to cyber espionage), and Andariel (often linked to ransomware activities). Each of these groups has sub-groups operating under them to carry out specific tasks.

Adding further complexity are several groups operating under the direction of the Central Committee of the Workers’ Party of Korea, such as the United Front Department and IT Workers, which conduct cyber operations domestically and abroad on behalf of the regime.

A Collaborative Response and Prioritization of Mission

Given the evolving nature and agility of these North Korean APT groups, it is recommended that defenders prioritize the specific nature of a particular activity rather than spending significant time attempting to attribute actions to specific individuals behind the keyboard. It is often challenging to attribute attacks to specific units, so a more productive approach would be to prioritize the mission after attributing the attacks to North Korea.

Mandiant suggests that future threat intelligence-gathering efforts should rely on a collaborative spirit, similar to that demonstrated by the North Korean APTs themselves. A more effective, collective response can be mounted by both governments and the private sector to counter this persistent threat actor. Such a unified front would maximize the cost imposed on the threat actor and increase the chances of success.

Editorial: The Heightened Threat of North Korean APTs

The increasing agility, adaptability, and complexity of North Korean APT groups pose a significant challenge to defenders in both the public and private sectors. The blurred lines between individual APTs, their collaborative efforts, and the sharing of tools and information make it harder than ever to track and attribute their malicious activities accurately. This demands a concerted and collaborative response from the international community to effectively counter these persistent threats.

It is crucial for governments, cybersecurity organizations, and the private sector to strengthen their collaborative efforts, share threat intelligence, and develop a unified front against North Korean APTs. By working together, defenders can enhance their ability to detect, mitigate, and respond to sophisticated cyber attacks originating from North Korea.

Advice for Defenders: A Unified Front and Continuous Vigilance

Defenders faced with the persistent and evolving threats posed by North Korean APT groups must prioritize a unified and collaborative front. Governments, cybersecurity companies, and private organizations should strive for increased information sharing, joint analysis, and synchronized response strategies to maximize the cost imposed on threat actors.

Continuous vigilance is essential, as the tactics, techniques, and procedures used by North Korean APT groups are constantly evolving. Defenders must remain proactive and adaptable in their defense strategies to effectively counter the sophisticated attacks carried out by these APT groups.

Additionally, investment in robust cybersecurity measures, employee training, and threat intelligence capabilities is crucial to bolster defenses against North Korean APTs. Organizations should regularly assess their security posture, implement multi-layered defenses, and ensure timely patching and updates to mitigate vulnerabilities that can be exploited by these threat actors.

In conclusion, the collaboration and adaptability demonstrated by North Korean APT groups present a formidable challenge to defenders worldwide. A unified front, continuous vigilance, and a proactive defense strategy are necessary to effectively counter and mitigate the evolving threats posed by these state-sponsored threat actors.