North Korean government hackers target individuals of interest, infosec professionals

The hacking unit is tasked with gathering strategic intelligence.

North Korean government hackers focused on gathering strategic intelligence have carried out a series of campaigns against media organizations and high-profile experts in the country’s affairs, while also preparing a campaign likely designed to target cybersecurity researchers, according to a new report from SentinelLabs.

The hacking unit — tracked as ScarCruft and believed to be working out of North Korea’s Ministry of State Security — was observed targeting the same experts repeatedly over November and December 2023, researchers Aleksandar Milenkoski and Tom Hegel reported Monday.

The operation’s targets were sent phishing emails that, if executed, sought to install the RokRAT backdoor, the researchers said.

As part of the research, Milenkoski and Hegel also retrieved malware in the planning and testing phase that used a technical research report on another long-running North Korean hacking campaign, Kimsuky, as a decoy, likely as an upcoming campaign set to target cybersecurity professionals.

“Given ScarCruft’s practice of using decoy documents relevant to targeted individuals, we suspect that the planned campaigns will likely target customers of technical threat intelligence reports, like threat researchers, cyber policy organizations, and other cybersecurity professionals,” Milenkoski and Hegel wrote.

The group is “likely pursuing non-public cyber threat intelligence and defense strategies,” Milenkoski wrote on LinkedIn. “This could benefit the constituent actors within the North Korean threat landscape, helping them in identifying threats to their operations.”

The approach is a known tactic among those following North Korean hacking operations. A sprawling operation that targeted information security professionals across a variety of social media platforms was uncovered in early 2021, for instance.

Taken together, the ongoing campaigns and the testing-phase malware show “ongoing dedication to gathering strategic intelligence through targeted attacks,” the researchers wrote Monday. The operations show the North Koreans’ “commitment to innovating its arsenal and expanding its target list, likely intending to target and/or masquerade as cybersecurity professionals or businesses.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure