Threat Group Cards: A Threat Actor Encyclopedia

APT group: [Unnamed groups: North Korea]

Names	[Unnamed groups: North Korea] (?)
Country	North Korea
Motivation	Information theft and espionage
First seen	2019
Description	These are reported APT activities attributed to a country, but not to an individual threat group.
Observed	Countries: France, USA.
Tools used
Operations performed	Aug 2019	Suspected North Korean Cyber Espionage Campaign Targets Multiple Foreign Ministries and Think Tanks <https://www.anomali.com/blog/suspected-north-korean-cyber-espionage-campaign-targets-multiple-foreign-ministries-and-think-tanks#When:14:00:00Z>
	Dec 2022	Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors <https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/#post-131292-_xkx0jjh1l9jy>
	Apr 2024	Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers Likely Associated With North Korean Threat Actors <https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/>
	Jul 2024	Research Update: Threat Actors Behind the DEV#POPPER Campaign Have Retooled and are Continuing to Target Software Developers via Social Engineering <https://www.securonix.com/blog/research-update-threat-actors-behind-the-devpopper-campaign-have-retooled-and-are-continuing-to-target-software-developers-via-social-engineering/>
	Aug 2024	South Korea says DPRK hackers stole spy plane technical data <https://www.bleepingcomputer.com/news/security/south-korea-says-dprk-hackers-stole-spy-plane-technical-data/>
Counter operations	Jan 2019	Justice Department Announces Court-Authorized Efforts to Map and Disrupt Botnet Used by North Korean Hackers <https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-efforts-map-and-disrupt-botnet-used-north>
	May 2024	US woman allegedly aided North Korean IT workers infiltrate 300 firms <https://www.bleepingcomputer.com/news/security/five-arizona-ukraine-charged-for-cyber-schemes-infiltrating-over-300-companies-to-benefit-north-koreas-weapons-program/>
	Aug 2024	Department Disrupts North Korean Remote IT Worker Fraud Schemes Through Charges and Arrest of Nashville Facilitator <https://www.justice.gov/usao-mdtn/pr/department-disrupts-north-korean-remote-it-worker-fraud-schemes-through-charges-and>
Information	<https://www.us-cert.gov/ncas/current-activity/2020/02/14/north-korean-malicious-cyber-activity> <https://www.us-cert.gov/ncas/alerts/aa20-106a> <https://www.us-cert.gov/ncas/current-activity/2020/05/12/north-korean-malicious-cyber-activity> <https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-187a> <https://www.us-cert.gov/ncas/current-activity/2018/08/09/North-Korean-Malicious-Cyber-Activity> <https://www.us-cert.gov/ncas/current-activity/2019/09/09/north-korean-malicious-cyber-activity> <https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/MTAC-East-Asia-Report.pdf> <https://unit42.paloaltonetworks.com/threat-assessment-north-korean-threat-groups-2024/> <https://www.ic3.gov/PSA/2024/PSA240903> <https://www.jamf.com/blog/jamf-threat-labs-observes-targeted-attacks-amid-fbi-warnings/> <https://www.knowbe4.com/hubfs/North-Korean-Fake-Employees-Are-Everywhere-WP_EN-us.pdf> <https://cloud.google.com/blog/topics/threat-intelligence/mitigating-dprk-it-worker-threat/> <https://dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86b.ssl.cf1.rackcdn.com/external/2024-10-01-security-advisory.pdf> <https://blog.barracuda.com/2024/10/02/north-korean-apt-groups-dmarc-misconfigurations> <https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/> <https://www.secureworks.com/blog/fraudulent-north-korean-it-worker-schemes>

Last change to this card: 24 October 2024

Download this actor card in PDF or JSON format