North Korean hackers stole military secrets, FBI reveals
A North Korean hacking group stole secrets about satellites and warplanes from Nasa, US air bases and defence contractors, the FBI has revealed, as it launched a hunt to catch the perpetrators.
The US government is offering a $10 million reward for information leading to the identity of hackers targeting American national security assets, including nuclear secrets and information about missiles, submarines and drones.
On Thursday, the US and UK published joint guidance for facilities that could be attacked by Andariel, a “malicious cyber group” controlled by North Korea’s military intelligence agency, the Reconnaissance General Bureau.
The US State Department said a North Korean national named Rim Jong Hyok was linked to the group, and had hacked into US hospitals and other healthcare providers to extort ransoms to fund its cyber attacks.
The goal of the group was to steal information from American and foreign defence contractors, who build military technology, the State Department said.
Hackers had access to Nasa system for three months
The hackers gained access to Nasa’s computer system for more than three months, extracting more than 17 gigabytes of unclassified data, according to an indictment of Mr Rim.
They also accessed computer systems of defence companies in Michigan and California, and air bases in Texas and Georgia, US authorities said.
“While North Korea uses these types of cyber crimes to circumvent international sanctions and fund its political and military ambitions, the impact of these wanton acts have a direct impact on the citizens of Kansas,” said Stephen Cyrus, an FBI agent based in Kansas City.
One US contractor was hacked in November 2022, and lost more than 30 gigabytes of data, including “unclassified technical information regarding material used in military aircraft and satellites”. Much of the information secured was more than 14 years old.
Mr Rim has been placed on the FBI’s most wanted list, and is charged with conspiracy to commit computer hacking and money laundering. Any information leading to him, Andariel or its associates carries a $10 million reward.
The Andariel group is one of several foreign hacking cells with links to North Korea or China that has been uncovered by US and UK law enforcement agencies in recent months.
In March, the FBI and UK National Cyber Security Centre (NCSC) traced attacks by APT 31, a Chinese group that launched attacks on email accounts belonging to MPs and US government officials and campaign staff.
National security threat is ‘broad and unrelenting’
The latest disclosure comes after Christopher Wray, the director of the FBI, said hacks from Chinese and other foreign groups posed a “broad and unrelenting” threat to US national security.
Ken McCallum, the director of MI5, said last year that his agency had more than doubled its work against Chinese activity in the last three years, and would double it again.
A briefing note released by the FBI and NCSC on Thursday said the North Korean hackers were based in Pyongyang and Sinuijuhad, and gained access to computer systems owned by defence contractors and healthcare providers by exploiting known vulnerabilities in software used by the companies.
The agencies released a wide-ranging list of targets in the nuclear, defence, aerospace and engineering sectors. The hackers have tried to steal secrets linked to fighter aircraft, missiles, satellites, shipbuilding, uranium enrichment and nuclear power plants.
Healthcare companies were targeted for confidential contracts, design drawings and project details. The group also encrypted computers and refused to unlock them unless they were paid, in an attack known as “ransomware”.
Paul Chichester, the NCSC director of operations, said: “The global cyber espionage operation that we have exposed today shows the lengths that DPRK state-sponsored actors are willing to go to pursue their military and nuclear programmes.
“It should remind critical infrastructure operators of the importance of protecting the sensitive information and intellectual property they hold on their systems to prevent theft and misuse.”
The agencies encouraged companies working on critical national infrastructure to update computer systems with security patches.
They said the hackers often made mistakes in their code, “indicating that the commands are not directly copied from a playbook and the actors have a flexible and impromptu approach” and a “poor grasp of the English language”.
Once gaining access, the group deployed “malware and other tools to maintain persistence, evade detection and exfiltrate data”.