aa24-207a-dprk-cyber-group-conducts-global-espionage-campaign.pdf (801 KB)

The joint CISA advisory attributes ongoing espionage to Andariel, also tracked as Onyx Sleet, DarkSeoul, Silent Chollima, Stonefly, and Clasiopa, under North Korea's RGB 3rd Bureau. The group targets defense, aerospace, nuclear, engineering, medical, and energy organizations to collect technical information, engineering documents, contract data, and other material useful to DPRK military and nuclear programs. The actors gain access by exploiting known web-server vulnerabilities such as Log4j and related CVEs, deploy web shells, enumerate systems, use Scheduled Tasks for persistence, steal credentials with tools such as Mimikatz, and move or exfiltrate data with custom malware, RATs, and open source tooling. The advisory also notes phishing with LNK or HTA files in ZIP archives and says ransomware against U.S. healthcare entities helps fund the espionage activity.