sb-nz logo
Story image

North Korea's threat actors operating from other countries

07 May 2018

Security firm Recorded Future says that North Korea most likely conducts malicious cyber operations from other countries including India, Malaysia, New Zealand, Nepal, Kenya, Mozambique, Indonesia, and China.

New Zealand may be an unlikely spot for North Korean activity, but the report, titled North Korea’s Ruling Elite Adapt Internet Behavior to Foreign Scrutiny, says it is primarily a hub for BitTorrent, video streaming, and gaming services.

“Over a three-day period in early January, a New Zealand Defence Forces IP attempted to repeatedly connect with North Korean networks. The activity was repetitive and noisy, but was not at the level where it would have caused a disruption of North Korean internet services,” the report claims.

“It is possible that New Zealand countered some North Korean operational activity through actions it undertook in August 2017 to deny visas to North Korean academics and its participation in United Nations and United States sanctions regimes.”

The report says that relations between Malaysia and North Korea have eroded, but North Koreans are still accessing emails from Malaysia.

This is a concern, says recorded future, because countries are hosting North Koreans who are conducting ‘illicit revenue-generation activities with the intent of circumventing international sanctions and to obtain advanced education, with the goal of progressing the North’s nuclear weapons and cyber operations programs’.

“North Korea uses its overseas diplomatic establishments, state-run restaurant chain, and citizens living abroad to facilitate illicit revenue generation and nuclear and cyber operations training. Thailand and Bangladesh host North Korean state-run restaurants, diplomatic establishments tied to criminal activity, and allow North Korean investment,” the report says.

North Korean malicious actors often use video counterfeiting, scams against online games and users to prop up the Kim Jong Un regime, the report claims.

Defectors claim they would earn $100,000 per year with 80% sent back to the Kim regime.

The people behind the malicious cyber operations would involve creating counterfeit videogames and bots that could steal digital items for resale at a profit. They would also find and sell new vulnerabilities in gaming software.

While North Korean’s elite internet users continue to change their digital environment, the medium is ‘indispensable’ to the Kim regime, particularly in the area of cyber operations.

“Tactical cyber operations, indicates how indispensable this medium is to the Kim regime. International efforts to restrict the activities and operational scope of this rogue nation must include sanctions or punitive measures on North Korean cyber operations.”

Story image
Zoom to begin rolling out end-to-end encryption
Available starting from next week, it represents the first phase out of four of the company’s greater E2EE offering, which was announced in May following backlash that the company was lax on its security and privacy.More
Story image
Insider threat report reveals deception in the workforce
Insider threats come from people inside an enterprise, whether they divulge proprietary information with nefarious intentions, or are just careless employees that unwittingly share sensitive data, writes Bitglass product marketing manager Juan Lugo.More
Story image
How cyber-attackers use Microsoft 365 tools to steal data
Vectra security research has recently identified how cyber-attackers use Microsoft Office 365 tools against organisations to steal data and take over accounts.More
Story image
NZX, Metservice attacks show Kiwi companies must rethink cyber security
The attacks are a wake-up call for New Zealand businesses to step up their threat protection and contingency planning systems.More
Story image
Video: 10 Minute IT Jams – A glimpse inside a ransomware cell
This is our second IT Jam with SonicWall senior manager of product marketing Brook Chelmo, and in this video Brook walks us through his one-on-one experience with a member of a ransomware cell. More
Story image
Why IT and HR must work together to help businesses weather the storm
Employers are striving to balance team productivity, security and employee engagement. If remote work is the new norm, it’s impossible to ignore the challenging nature of the situation, writes Gigamon manager for A/NZ George Tsoukas.More