North Korean government hackers sanctioned by U.S. Treasury

The U.S. Treasury Department is sanctioning three North Korean hacking groups it says are backed by Kim Jong-un’s regime.

Add the U.S. Treasury to the list of government agencies going after North Korean hackers.

The Treasury’s Office of Foreign Assets Control announced Friday it is sanctioning three North Korean hacking groups it says are backed by Kim Jong-un’s regime, including the well-known Lazarus Group. The office also identifies two sub-groups of Lazarus Group, Bluenoroff and Andariel.

Bluenoroff has targeted foreign financial institutions in Bangladesh, India, Mexico, Pakistan, Philippines, South Korea, Taiwan, Turkey, Chile, and Vietnam, as well as the Society for Worldwide Interbank Financial Telecommunication (SWIFT) monetary transfer system to conduct cyber-enabled financial heists in response to prior sanctions, according to OFAC.

Andariel has been more focused on stealing cash and customer information from ATMs as well as targets in government agencies and in the defense industry, including those in South Korea to gather intelligence, according to OFAC.

The U.S. government has previously linked Lazarus Group with the North Korean government.

OFAC has designated all three as “agencies, instrumentalities, or controlled entities” of North Korea’s primary intelligence agency, the Reconnaissance General Bureau (RGB).

“Treasury is taking action against North Korean hacking groups that have been perpetrating cyber attacks to support illicit weapon and missile programs,” said Sigal Mandelker, Treasury’s under secretary for terrorism and financial intelligence.  “We will continue to enforce existing U.S. and UN sanctions against North Korea and work with the international community to improve cybersecurity of financial networks.”

This comes weeks after the UN revealed North Korea has been stealing $2 billion through cyberattacks to finance its weapons programs, and just as the regime says it’s willing to come back to the negotiating table with the Trump administration on denuclearization.

There has been a broader government effort to ratchet up the pressure on North Korea as of late. Cyber Command has also been sending warning signs to North Korea in recent weeks, including uploads of malware samples to VirusTotal last month that security researchers linked with Lazarus Group.

Last Sunday, Cyber Command uploaded its largest-ever sample set to VirusTotal, which security researchers also linked with North Korea. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency has also been coordinating with Cyber Command to warn private sector about the malware, as CyberScoop first reported.

These CISA and Cyber Command actions are taking place “as part of an ongoing effort to protect the U.S. financial system and other critical infrastructure as well as to have the greatest impact on improving global security,” according to the Treasury department release on the sanctions designation.

“This, along with today’s OFAC action, is an example of a government-wide approach to defending and protecting against an increasing North Korean cyber threat and is one more step in the persistent engagement vision set forth by USCYBERCOM,” the Treasury notice reads.

The U.S. government has also said North Korean hackers, specifically Lazarus Group, are responsible for the WannaCry ransomware attack that impacted 150 countries and thousands of computers. Department of Justice charged a North Korean computer programmer in connection with those attacks last year.

North Korean hackers don’t appear to be stopping any time soon. As denuclearization talks have stalled, North Korean hackers have been targeting U.S. entities with malicious decoy documents, Prevailion researchers tell CyberScoop. They have also been employing new methods — using more obscure file-types that many antivirus products don’t detect — intended to better cover their tracks and evade detection. North Korean hackers have also appeared to be targeting organizations focused on North Korea’s missile program via malicious websites that appear to be login pages for government agencies and think tanks.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure