The National Office of Investigation (NOI), provides a briefing on emails sent by North Korean hackers, using false identities of South Korean government agencies and news organizations, at the NOI headquarters in Seoul, South Korea. Photo by YONHAP / EPA
May 14 (Asia Today) — A North Korean hacking group linked to the country’s military intelligence agency has posed as police investigators, defense officials and North Korea experts in spear phishing attacks targeting South Korean security and policy figures, a cybersecurity company said Thursday.
Genians, a South Korean information security company, said it detected cyberattacks suspected of being linked to APT37, a North Korea-backed hacking group associated with the Reconnaissance General Bureau.
The group is known for cyber espionage targeting people involved in North Korea affairs and for hacking operations aimed at financial gain.
The latest attacks targeted people working in defense, national security and North Korea-related fields. Spear phishing is a targeted hacking method that uses customized messages and information to trick specific individuals, rather than sending generic malicious emails to large groups.
Hackers used personal details to build trust
According to Genians, the hackers used a range of impersonation tactics to lower victims’ guard, including posing as police officers, defense officials, airline ticket issuers and North Korea research groups.
In one message, the hackers claimed they had obtained North Korean nuclear power plant materials and were preparing a program to help researchers better understand the subject.
In another, a person claiming to be a police investigator said a hacking case had uncovered the recipient’s email address on a suspicious server.
The attackers also used publicly available information and personal data obtained through previous hacking attempts to make their messages appear credible.
In some cases, they used actual names, affiliations and background information before creating emotional rapport, such as claiming to be a defense official approaching retirement who wanted to work on meaningful projects with others in the same field.
Genians said the attacks continued through last month. The final save time of one malicious file was identified as the morning of April 17.
The document was linked to an account named “Lailey,” which Genians said was also used in 2022 attacks impersonating the National Unification Advisory Council and the U.N. human rights office in Seoul.
North Korea seen strengthening cyber operations
The report comes after North Korea reorganized and renamed several intelligence bodies.
In March, North Korea changed the name of its Ministry of State Security to the State Intelligence Bureau. Last September, it expanded and renamed the Reconnaissance General Bureau as the Reconnaissance Intelligence General Bureau.
The Reconnaissance Intelligence General Bureau is believed to be the organization behind APT37.
Genians said the use of the word “intelligence” in both agencies’ names suggests North Korea is seeking to strengthen its external information collection, analysis and cyber operations.
Cybersecurity experts warned that ordinary cryptocurrency holders could also become targets because North Korea uses hacking to generate foreign currency.
South Korea’s National Intelligence Service has said North Korea stole more than 2 trillion won, or about $1.4 billion, through cryptocurrency and other hacking operations targeting South Koreans and foreign virtual assets last year. The agency said it was the largest amount ever stolen by North Korean hackers.
North Korea is also believed to use cyberattacks to steal defense, information technology and other industrial technologies.
— Reported by Asia Today; translated by UPI
© Asia Today. Unauthorized reproduction or redistribution prohibited.
About the Author
