Story image

North Korea's threat actors operating from other countries

07 May 18

Security firm Recorded Future says that North Korea most likely conducts malicious cyber operations from other countries including India, Malaysia, New Zealand, Nepal, Kenya, Mozambique, Indonesia, and China.

New Zealand may be an unlikely spot for North Korean activity, but the report, titled North Korea’s Ruling Elite Adapt Internet Behavior to Foreign Scrutiny, says it is primarily a hub for BitTorrent, video streaming, and gaming services.

“Over a three-day period in early January, a New Zealand Defence Forces IP attempted to repeatedly connect with North Korean networks. The activity was repetitive and noisy, but was not at the level where it would have caused a disruption of North Korean internet services,” the report claims.

“It is possible that New Zealand countered some North Korean operational activity through actions it undertook in August 2017 to deny visas to North Korean academics and its participation in United Nations and United States sanctions regimes.”

The report says that relations between Malaysia and North Korea have eroded, but North Koreans are still accessing emails from Malaysia.

This is a concern, says recorded future, because countries are hosting North Koreans who are conducting ‘illicit revenue-generation activities with the intent of circumventing international sanctions and to obtain advanced education, with the goal of progressing the North’s nuclear weapons and cyber operations programs’.

“North Korea uses its overseas diplomatic establishments, state-run restaurant chain, and citizens living abroad to facilitate illicit revenue generation and nuclear and cyber operations training. Thailand and Bangladesh host North Korean state-run restaurants, diplomatic establishments tied to criminal activity, and allow North Korean investment,” the report says.

North Korean malicious actors often use video counterfeiting, scams against online games and users to prop up the Kim Jong Un regime, the report claims.

Defectors claim they would earn $100,000 per year with 80% sent back to the Kim regime.

The people behind the malicious cyber operations would involve creating counterfeit videogames and bots that could steal digital items for resale at a profit. They would also find and sell new vulnerabilities in gaming software.

While North Korean’s elite internet users continue to change their digital environment, the medium is ‘indispensable’ to the Kim regime, particularly in the area of cyber operations.

“Tactical cyber operations, indicates how indispensable this medium is to the Kim regime. International efforts to restrict the activities and operational scope of this rogue nation must include sanctions or punitive measures on North Korean cyber operations.”

JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t. 
Pitfalls to avoid when configuring cloud firewalls
Flexibility and granularity of security controls is good but can still represent a risk for new cloud adopters that don’t recognise some of the configuration pitfalls.
CERT NZ highlights rise of unauthorised access incidents
“In one case, the attacker gained access and tracked the business’s emails for at least six months. They gathered extensive knowledge of the business’s billing cycles."
Report finds GCSB in compliance with NZ rights
The Inspector-General has given the GCSB its compliance tick of approval for the fourth year in a row.
Securing hotel technology to protect customer information
Network security risks increase exponentially as hotels look to incorporate newer technologies to support a range of IoT devices, including smart door locks.
Why total visibility is the key to zero trust
Over time, the basic zero trust model has evolved and matured into what Forrester calls the Zero Trust eXtended (ZTX) Ecosystem.
Gartner names Proofpoint Leader in enterprise information archiving
The report provides a detailed overview of the enterprise information archiving market and evaluates vendors based on completeness of vision and ability to execute.
WatchGuard appoints new channel distributors in A/NZ
The appointments will enable WatchGuard to expand its regional channel reseller footprint.