Story image

North Korea's threat actors operating from other countries

07 May 2018

Security firm Recorded Future says that North Korea most likely conducts malicious cyber operations from other countries including India, Malaysia, New Zealand, Nepal, Kenya, Mozambique, Indonesia, and China.

New Zealand may be an unlikely spot for North Korean activity, but the report, titled North Korea’s Ruling Elite Adapt Internet Behavior to Foreign Scrutiny, says it is primarily a hub for BitTorrent, video streaming, and gaming services.

“Over a three-day period in early January, a New Zealand Defence Forces IP attempted to repeatedly connect with North Korean networks. The activity was repetitive and noisy, but was not at the level where it would have caused a disruption of North Korean internet services,” the report claims.

“It is possible that New Zealand countered some North Korean operational activity through actions it undertook in August 2017 to deny visas to North Korean academics and its participation in United Nations and United States sanctions regimes.”

The report says that relations between Malaysia and North Korea have eroded, but North Koreans are still accessing emails from Malaysia.

This is a concern, says recorded future, because countries are hosting North Koreans who are conducting ‘illicit revenue-generation activities with the intent of circumventing international sanctions and to obtain advanced education, with the goal of progressing the North’s nuclear weapons and cyber operations programs’.

“North Korea uses its overseas diplomatic establishments, state-run restaurant chain, and citizens living abroad to facilitate illicit revenue generation and nuclear and cyber operations training. Thailand and Bangladesh host North Korean state-run restaurants, diplomatic establishments tied to criminal activity, and allow North Korean investment,” the report says.

North Korean malicious actors often use video counterfeiting, scams against online games and users to prop up the Kim Jong Un regime, the report claims.

Defectors claim they would earn $100,000 per year with 80% sent back to the Kim regime.

The people behind the malicious cyber operations would involve creating counterfeit videogames and bots that could steal digital items for resale at a profit. They would also find and sell new vulnerabilities in gaming software.

While North Korean’s elite internet users continue to change their digital environment, the medium is ‘indispensable’ to the Kim regime, particularly in the area of cyber operations.

“Tactical cyber operations, indicates how indispensable this medium is to the Kim regime. International efforts to restrict the activities and operational scope of this rogue nation must include sanctions or punitive measures on North Korean cyber operations.”

Kiwis know security is important, but they're not doing much about it
Only 49% of respondents use antivirus software and even fewer – just 19% -  change their passwords regularly.
Avi Networks: Using visibility to build trust
Visibility, also referred to as observability, is a core tenet of modern application architectures for basic operation, not just for security.
Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Myth-busting assumptions about identity governance - SailPoint
The identity governance space has evolved and matured over the past 10 years, changing with the world around it.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.