The National Cyber Security Council and international allies have exposed a global cyber espionage campaign carried out by attackers which the NCSC alleges are sponsored by North Korea.

Alongside the United States and the Republic of Korea, the NCSC revealed how a cyber threat group known as Andariel has been compromising organisations around the world to steal sensitive and classified technical information and intellectual property data.

The NCSC has assessed that Andariel is a part of DPRK’s Reconnaissance General Bureau (RGB) 3rd Bureau and that the group’s malicious cyber activities pose an ongoing threat to critical infrastructure organisations globally.

The cyber actors have primarily targeted defence, aerospace, nuclear and engineering entities, and organisations in the medical and energy sectors to a lesser extent, order to obtain information such as contract specification, design drawings and project details.

As part of its operations, Andariel has also launched ransomware attacks against US healthcare organisations in order to extort payments and fund further espionage activity.

This advisory shares technical details and mitigations advice to help defend against the actors who have been seen exploiting known vulnerabilities to access victims’ systems before deploying malware and other tools to maintain persistence, evade detection, and exfiltrate data.

“The global cyber espionage operation that we have exposed today shows the lengths that DPRK state-sponsored actors are willing to go to pursue their military and nuclear programmes,” Pail Chichester, NCSC director of operations, said.

“It should remind critical infrastructure operators of the importance of protecting the sensitive information and intellectual property they hold on their systems to prevent theft and misuse.

“The NCSC, alongside our US and Korean partners, strongly encourage network defenders to follow the guidance set out in this advisory to ensure they have strong protections in place to prevent this malicious activity.”

The advisory, co-sealed by the NCSC, and complimentary US and Republic of Korea intelligence agencies, outlines how Andariel has evolved its operations from conducting destructive attacks targeting US and South Korea organisations to conducting specialised cyber espionage and ransomware attacks.

Recommended reading

• What Cybersecurity Trends are Emerging in 2024?
• 90% of Cyber Threats Rely on Social Engineering
• NHS Dumfries and Galloway Stolen Data Published on Dark Web

It warns that in some cases the actors have been observed launching ransomware attacks and espionage operations on the same day and leveraging both activities against the same victim.

“The latest advisory from the NCSC and its international partners is deeply concerning,” Andy Ward, VP international of Absolute Security said.

“The revelation that North Korean state-sponsored actors, particularly the Andariel group, are aggressively targeting critical infrastructure and sensitive sectors such as defence, aerospace, nuclear, and healthcare is a strong reminder of the evolving cyber threat landscape.”