US Turning Up the Heat on North Koreas Cyber Threat Operations

Sanctions on North Korean nation-state hacking groups came amid reports of fresh malicious campaigns directed at US entities from the isolated nation.

The US governments move last Friday to slap
sanctions
on three North Korean cyber threat groups is being viewed by some security experts as a necessary but likely futile attempt to slow down state-sponsored hacking activity in that country.
The sanctions came amid reports of fresh threat activity targeted at US interests from North Korea. The US DHS and the FBI warned of new malware activity related to Hidden Cobra, a DDoS botnet previously linked to North Koreas intelligence apparatus. In another report, security vendor Prevailion said it had observed a recent expansion of a North Korean threat campaign dubbed Autumn Aperture directed at US organizations in multiple industries.
The US Department of Treasury announced the sanctions against North Koreas Lazarus Group and two of its sub-groups Bluenoroff and Andarie. All three are accused of working for the Reconnaissance General Bureau (RGB) North Korea’s primary intelligence agency to support the countrys missile and weapons programs.
Lazarus Group is best known for its involvement in the WannaCry 2.0 attacks of December 2017 and the crippling breach at Sony in 2014. Security researchers believe Bluernoroff was established to earn money for the cash-strapped sanctions-hit North Korean government. The group has been linked to attacks on banks in Bangladesh, India, South Korea, Mexico and several other countries and is believed to have stolen tens of millions of dollars in these cyber heists. Andaries mission is thought to be similar, though this groups attacks have focused on bankcard theft and ATM hacking.
In a
statement
announcing the sanctions, the Treasury Department described the three threat groups as being directly controlled by the North Korean government and being used to perpetuate the countrys broader nuclear and military goals. The sanctions prohibit all dealings by US individuals and business with the three threat groups and any entities believed associated with them in a meaningful way. It also puts strictures on any properties or business deals the groups or their associates might have in the US.
The big question is whether the sanctions will have any deterrent impact considering the targeted groups are not based in the US nor are likely to have any meaningful assets or interests that can be seized here.
Sanctions are, arguably ineffective and laughable, says Chris Roberts, chief security strategist at Attivo Networks.
US sanctions on North Korea for more than 25 years over its nuclear program have had little direct effect and it is likely the new ones against the three threat groups will do much to deter them, he says. Their business is breaking the law so merely telling them to stop will do little to change things on the ground Roberts notes. Their tools, technologies and systems are in place, and anything they need they can readily get from the rest of the world with little difficulty.
John Hultquist, director of intelligence at FireEye, says over the past several years North Koreas cyber espionage apparatus has evolved into a significant state-run criminal enterprise. North Korea has continuously improved their capability, especially with regards to their financially-motivated schemes, which often involve innovative tools and techniques, he says.
Its hard to judge the effectiveness of sanctions and indictments, which are two of the tools the US has attempted to leverage to alter the behavior of threat actors in other countries as well including in China, Russia, and Iran. Some, like China and Iran, have notably changed their behavior in the past, he notes. But internal restructuring, or a warming relationship with the US may have caused the changes, rather than [sanctions], he says.
Autumn Aperture Campaign
Meanwhile,
Prevailion
last week said it had observed a spike in activity related to Autumn Aperture, a cyber-espionage campaign targeting US organizations. The security vendor has linked the campaign with a moderate level of certainty to a North Korean advanced persistent threat group called Kimsuky or Smoke Screen.
Prevailion said its researchers have recently observed the threat actors behind the Autumn Aparture campaign using documents discussing North Korean nuclear deterrence and its nuclear submarine program as lures in malware-laden emails.
The documents that are being used are all legitimate documents written by industry experts. What the threat actors are doing is appending their malware to the documents and sending them out as attachments to targeted recipients—sometimes using obscure file formats such as Kodak FlashPix to evade detection.
Danny Adamitis, director of intelligence analysis at Prevailion, says with the latest campaign the threat actors have added functionality to check for the presence of various anti-virus products before downloading the secondary payload. Prevailion assesses that the threat actor is a persistent threat that will continue to pose a threat to US based think tanks and their partners, particularly those involved in national security based upon historical targeting trends, Adamitis says.
The
DHS and FBI last week also released alerts on malware
activity tied to North Korea. The two agencies reported on an IP tunneling tool called ELECTRICFISH and a Trojan dubbed BADCALL that they described as being linked to the North Korean Hidden Cobra botnet.
Related Content:
North Korea Seen Using ELECTRICFISH, BADCALL Malware Variants
US Warns of North Koreas Not-So-Secret Hidden Cobra DDoS Botnet
North Koreas Lazarus Group Targets Russian Companies For First Time
2019 Attacker Playbook
Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays top story:
Escaping Email: Unlocking Message Security for SMS, WhatsApp
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
US Turning Up the Heat on North Koreas Cyber Threat Operations