North Korea ransomware targets hospitals to fund digital spycraft, US agencies warn

U.S. and South Korea officials say that North Korean ransomware operators are funding espionage operations through cyberattacks on hospitals.

North Korea is deploying ransomware in the health care sector to supplement cyber ops against the U.S. and South Korean governments, according to a joint alert released Thursday from multiple U.S. and South Korean agencies.

Furthermore, the alert from the National Security Agency, FBI, Cybersecurity and Infrastructure Security Agency, Department of Health and Human Services, the Republic of Korea’s Defense Security Agency and the National Intelligence Service warns that Pyongyang is using the illicit cryptocurrencies obtained from the attacks to support state-backed espionage operations that target U.S. defense networks and the defense industrial base.

The joint release is just the latest warning from U.S. government officials that ransomware attacks originating in North Korea have grown into a national security crisis. In fact, many cyber officials and lawmakers have called for additional regulations to ensure health care organizations are implementing proper cybersecurity protections to help defend against the ongoing scourge of ransomware.

John Hultquist, head of threat intelligence at the cybersecurity firm Mandiant, noted on Twitter that his company has connected the ransomware targeting hospitals to the threat group known as Andariel, which has caused major disruptions at health care facilities.

“Andariel does not appear to be focused on fund-raising like some of their peers. They are still carrying out the old school intelligence mission, targeting government, the defense sector, NGOs and others. They may be doing this just to keep the lights on,” Hultquist noted.

Thursday’s warning from government agencies follows a June alert by CISA, FBI and the Treasury Department detailing how North Korean state hackers are using the Maui ransomware to target the health care sector, too. However, the most recent notice says that North Korean hackers also used other types of ransomware such as H0lyGh0st and deploy encryption tools such as LockBit 2.0.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure