An increasingly sophisticated North Korean cyber-espionage unit is using its skills to widen spying operations to aerospace and defence industries, a new study has revealed.
FireEye, a US private security company that tracks cyber-attackers around the world, has identified a North Korean group, which it names APT37 (Reaper) and which it says is using malware to infiltrate computer networks.
The report suggests the group has been active since 2012, but has now graduated to the level of an advanced persistent threat.
Until now, the group has substantially focused its cyber-espionage efforts on South Korea, but FireEye outlines evidence that it “has expanded its operations in both scope and sophistication”.
“We assess with high confidence that this activity is carried out on behalf of the North Korean government,” the report says.
The group’s cyber operation is now said to be targeting Japan, Vietnam and the Middle East and is attempting to steal secrets from companies and organisations involved in the chemical, electronics, manufacturing, aerospace, automotive and healthcare industries.
“We judge that APT37’s primary mission is covert intelligence gathering in support of North Korea’s strategic, military, political and economic interests,” the report says.
The report comes after months of increasingly hot rhetoric between Kim Jong-un and Donald Trump amid US fears that North Korea is its biggest threat, as Pyongyang makes progress in developing a nuclear warhead and ballistic missile system capable of hitting the US mainland.
The scale of North Korea’s cyber-espionage effort was outlined in 2015 when South Korea claimed the north’s “cyber army” had doubled in size to more than 6,000 people.
In December last year, it was suggested the UK and US may have launched retaliatory cyber-attacks against North Korea. The UK and the Trump administration blamed North Korea for the WannaCry malware attacks which brought chaos to hospitals, banks and other companies in May 2017.
“The attack was widespread and cost billions, and North Korea is directly responsible,” Tom Bossert, Trump’s homeland security adviser, wrote in the Wall Street Journal.
John Hultquist, director of intelligence analysis at FireEye, said APT37 had so far received very little public attention.
“We have been tracking their actions for some time, gathering clues from incidents mainly focused in South Korea. North Korea is an increasingly aggressive actor willing to leverage a variety of tools against their neighbours and the world,” he said.
“Previous incidents, such as the WannaCry attacks, have been a surprise. If we want to neutralize this surprise, we have to seek out these actors and expose them.”
APT37’s targets have included:
- A Middle Eastern company that entered into a joint venture “that had gone bad” to provide North Korea with telecommunications service.
- Individuals involved in trade and international affairs issues.
- Individuals working with Olympics organisations.
- A journalist and a research fellow associated with North Korean human rights issues.
- An entity in Japan associated with United Nations missions on sanctions and human rights.
Methods used by the group included sending to a board member of a Middle Eastern financial company a malicious document disguised as a bank liquidation letter, which used a vulnerability in Microsoft Office that had only been disclosed one month earlier.
Once opened, the document communicated with a compromised website to surreptitiously install a ‘backdoor’ tool that allowed the group to collect system information, take screenshots and download more malicious files to the victimized computer.
The group is also said to go after South Korean targets using emails promising links to websites about Korean reunification.
Compromised websites, including a news site for North Korean defectors and refugees, an aromatherapy site and a scuba diving website were all used to avoid detection and deliver “malicious malware payloads” designed to infect servers.
The fact that the group quickly incorporated recently publicised vulnerabilities into its spear-phishing emails “suggest a high operational tempo and specialized expertise”, FireEye concludes.
“Their malware is characterised by a focus on stealing information from victims, with many set up to automatically exfiltrate data of interest,” the report says, adding: “We assess with high confidence that APT37 acts in support of the North Korean government and is primarily based in North Korea.
“An individual we believe to be the developer behind several APT37 malware payloads inadvertently disclosed personal data showig that the actor was operating from an IP address and access point associated with North Korea.”
One piece of malware called DogCall is capable of capturing screenshots, keystrokes and getting into cloud storage services like Dropbox. It was used to target South Korea government and military organisations in March and April 2017.
A “wiper tool” called RUHappy was also deployed, meant to render systems inoperable.
