South Korea’s nuclear research agency breached by North Korea-affiliated cyberattackers, says malware analyst group
(2021/06/21)
- Reference: 1624253635
- News link: https://www.theregister.co.uk/2021/06/21/south_koreas_nuclear_think_tank/
- Source link:
South Korean officials have admitted that government nuclear think tank Korea Atomic Energy Research Institute (KAERI) was hacked in May 2021 by North Korea’s Kimsuky group. The Korean news outlet that broke the story has accused KAERI of a cover-up.
Malware analyst group IssueMakersLab said in a [1]report that it detected an attack on KAERI on May 14th. The attack saw incoming heat from 13 internet addresses, of which one was traceable to Kimsuky.
The Kimsuky group is not new. According to the [2]US Cybersecurity and Infrastructure Security Agency (CISA) , the group is believed to be a North Korean global intelligence gathering mission, operating since 2012. The group — which also goes by Velvet Chollima, Black Banshee, and Thallium — is believed responsible for numerous malware attacks, and in the past has targeted South Korean COVID-19 vaccine researchers and nuclear reactors.
[3]
The group often uses phishing to mimic websites like GMail, Outlook, Telegram and more. The group then installs Android and Windows backdoor “AppleSeed” to collect information.
[4]
[5]
Korea’s Ministry of Science and ICT (MSIT) [6]said a vulnerability in a VPN used by KAERI allowed access to one of the agency’s servers. KAERI said it discovered the attack on May 31st and then took steps to block the IP addresses and install security patches.
South Korean news agency [7]Yonhap has reported that the KAERI network was breached using an email address from President Moon Jae-in’s former advisor, Moon Chung-in, that was acquired during a 2018 Kimsuky-attributed cyberattack.
[8]South Korea has a huge problem with digital sex crimes against women says Human Rights Watch
[9]North Korean attacks on crypto exchanges reportedly netted $316m in two years
[10]Biden administration labels China top tech threat, promises proportionate responses to cyberattacks
[11]South Korea bans 1700 tech products for using forged test reports
The extent of damage has not been confirmed, said MSIT on Friday. Officials fear that the leaking of information pertaining to nuclear technology, like reactors and fuel rods, could pose security risks.
The attack was first reported by Korean news outlet, SISA Journal , which [12]accused KAERI of concealing the breach. The journal cited a researcher who changed his position on the breach and related damage three times.
[13]
In response to the cover-up accusations, KAERI issued a [14]statement describing (after machine translation) the researcher’s inconsistencies as follows:
The statement that “there was no hacking incident” was a mistake in the response of the working-level staff, which occurred in a situation where damage was not confirmed during investigation due to suspected infringement.
The attack on KAERI may be part of a larger ongoing campaign. Earlier this month, Malwarebytes [15]reported a number of attacks on South Korean universities, government officials, and companies in South Korea, and attributed them to Kimsuky. ®
Get our [16]Tech Resources
[1] http://www.issuemakerslab.com/
[2] https://us-cert.cisa.gov/ncas/alerts/aa20-301a
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YNBjRypUYOoqo-OQui@ziAAAAJM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNBjRypUYOoqo-OQui@ziAAAAJM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YNBjRypUYOoqo-OQui@ziAAAAJM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.msit.go.kr/bbs/view.do?sCode=user&mId=115&mPid=111&pageIndex=&bbsSeqNo=86&nttSeqNo=3179830&searchOpt=ALL&searchTxt=
[7] https://en.yna.co.kr/view/AEN20210618007200315
[8] https://www.theregister.com/2021/06/17/human_rights_watch_south_korea_digital_crime_against_women_report/
[9] https://www.theregister.com/2021/02/10/north_korea_cryptocurrency/
[10] https://www.theregister.com/2021/03/05/bide_administration_interim_national_security_guidance/
[11] https://www.theregister.com/2021/06/18/south_korea_rejects_bacl_chna_tests/
[12] https://www.sisajournal.com/news/articleView.html?idxno=219152
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNBjRypUYOoqo-OQui@ziAAAAJM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[14] https://www.kaeri.re.kr/board/view?menuId=MENU00326&linkId=9181
[15] https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/
[16] https://whitepapers.theregister.com/
Malware analyst group IssueMakersLab said in a [1]report that it detected an attack on KAERI on May 14th. The attack saw incoming heat from 13 internet addresses, of which one was traceable to Kimsuky.
The Kimsuky group is not new. According to the [2]US Cybersecurity and Infrastructure Security Agency (CISA) , the group is believed to be a North Korean global intelligence gathering mission, operating since 2012. The group — which also goes by Velvet Chollima, Black Banshee, and Thallium — is believed responsible for numerous malware attacks, and in the past has targeted South Korean COVID-19 vaccine researchers and nuclear reactors.
[3]
The group often uses phishing to mimic websites like GMail, Outlook, Telegram and more. The group then installs Android and Windows backdoor “AppleSeed” to collect information.
[4]
[5]
Korea’s Ministry of Science and ICT (MSIT) [6]said a vulnerability in a VPN used by KAERI allowed access to one of the agency’s servers. KAERI said it discovered the attack on May 31st and then took steps to block the IP addresses and install security patches.
South Korean news agency [7]Yonhap has reported that the KAERI network was breached using an email address from President Moon Jae-in’s former advisor, Moon Chung-in, that was acquired during a 2018 Kimsuky-attributed cyberattack.
[8]South Korea has a huge problem with digital sex crimes against women says Human Rights Watch
[9]North Korean attacks on crypto exchanges reportedly netted $316m in two years
[10]Biden administration labels China top tech threat, promises proportionate responses to cyberattacks
[11]South Korea bans 1700 tech products for using forged test reports
The extent of damage has not been confirmed, said MSIT on Friday. Officials fear that the leaking of information pertaining to nuclear technology, like reactors and fuel rods, could pose security risks.
The attack was first reported by Korean news outlet, SISA Journal , which [12]accused KAERI of concealing the breach. The journal cited a researcher who changed his position on the breach and related damage three times.
[13]
In response to the cover-up accusations, KAERI issued a [14]statement describing (after machine translation) the researcher’s inconsistencies as follows:
The statement that “there was no hacking incident” was a mistake in the response of the working-level staff, which occurred in a situation where damage was not confirmed during investigation due to suspected infringement.
The attack on KAERI may be part of a larger ongoing campaign. Earlier this month, Malwarebytes [15]reported a number of attacks on South Korean universities, government officials, and companies in South Korea, and attributed them to Kimsuky. ®
Get our [16]Tech Resources
[1] http://www.issuemakerslab.com/
[2] https://us-cert.cisa.gov/ncas/alerts/aa20-301a
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YNBjRypUYOoqo-OQui@ziAAAAJM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNBjRypUYOoqo-OQui@ziAAAAJM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YNBjRypUYOoqo-OQui@ziAAAAJM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.msit.go.kr/bbs/view.do?sCode=user&mId=115&mPid=111&pageIndex=&bbsSeqNo=86&nttSeqNo=3179830&searchOpt=ALL&searchTxt=
[7] https://en.yna.co.kr/view/AEN20210618007200315
[8] https://www.theregister.com/2021/06/17/human_rights_watch_south_korea_digital_crime_against_women_report/
[9] https://www.theregister.com/2021/02/10/north_korea_cryptocurrency/
[10] https://www.theregister.com/2021/03/05/bide_administration_interim_national_security_guidance/
[11] https://www.theregister.com/2021/06/18/south_korea_rejects_bacl_chna_tests/
[12] https://www.sisajournal.com/news/articleView.html?idxno=219152
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNBjRypUYOoqo-OQui@ziAAAAJM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[14] https://www.kaeri.re.kr/board/view?menuId=MENU00326&linkId=9181
[15] https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/
[16] https://whitepapers.theregister.com/
Why is North Korea connected to the Internet ?
Pascal Monett
NK is a rogue state. It is completely untrustworthy and its citizens have no access without special authorization.
Ergo, the only Norks connected to the Web are likely nefarious and up to no good. Who maintains their Internet connection and why is that not just cut off ?
I am well aware that that would be an extreme measure, but we're talking about North Korea, not Russia. North Korea is a wart on the world diplomatic map. The sooner it collapses under the weight of its own incompetence, the better.
Our weekly propaganda bring us on Monday, please!
_LC_
Sure this wasn't Iran, Russia or China?
Thanks to the US, a fuckhead "hardliner" has won the elections in Iran, just like they wanted. Whenever there was a moderate government, which did well for the people, the US intervened and brought their fuckheads (the ones who scream "Death to America!" the loudest) back to power.
With NK they are doing the same - ensuring that their stooges are being kept in power.
Still a work in early progress in need of greater fundamental fettling
That machine translation highlights the abiding problem with such facilities/utilities ..... less than perfect permits faulty information a foothold in circles providing it analysed as intelligence to be either ignored or acted upon, which are the only two real options to be considered. Both are less than future helpful.