Pierluigi Paganini April 16, 2020

The United States agencies released a joint advisory warning of ‘significant cyber threat’ posed by North Korea-linked hackers to the global financial sector.

The U.S. Departments of State, the Treasury, and Homeland Security, and the Federal Bureau of Investigation released a joint advisory that is warning organizations worldwide about the ‘significant cyber threat’ posed by the North Korean nation-state actors to the global banking and financial institutions.

The advisory contains comprehensive resources on the North Korean cyber
threat that aims at helping the international community, industries, and other governments to protect their infrastructure from state-sponsored attacks. The document also includes a list of recent attacks attributed to North Korean state-sponsored hackers.

“The DPRK’s malicious cyber activities threaten the United States and the broader international community and, in particular, pose a significant threat to the integrity and stability of the international financial system. Under the pressure of robust U.S. and UN sanctions, the DPRK has increasingly relied on illicit activities – including cybercrime – to generate revenue for its weapons of mass destruction and ballistic missile programs.” reads the advisory.

“In particular, the United States is deeply concerned about North Korea’s malicious cyber activities, which the U.S. government refers to as HIDDEN COBRA. The DPRK has the capability to conduct disruptive or destructive cyber activities affecting U.S. critical infrastructure,”

Due to the pressure of U.S. and UN sanctions, North Korea has increasingly relied on cyber capabilities to target banks and financial institutions and to generate revenues.

“In particular, the United States is deeply concerned about North Korea’s malicious cyber activities, which the U.S. government refers to as HIDDEN COBRA.” continues the advisory.

“The DPRK also uses cyber capabilities to steal from financial institutions, and has demonstrated a pattern of disruptive and harmful cyber activity that is wholly inconsistent with the growing international consensus on what constitutes responsible state behavior in cyberspace.”

“They develop and deploy a wide range of malware tools around the world to enable these activities and have grown increasingly sophisticated.”

According to the experts, the state-sponsored hackers have attempted to steal as much as $2 billion through these cyber activities.

The U.S. government is also offering a monetary reward of up to $5 million to anyone who can provide ‘information about the activities carried out by North Korea-linked APT groups. The offer also includes information about past hacking campaigns.

“If you have information about illicit DPRK activities in cyberspace, including past or ongoing operations, providing such information through the Department of State’s Rewards for Justice program could make you eligible to receive an award of up to $5 million.” states the advisory.

“To support international efforts to disrupt North Korea’s illicit activities, the State Department’s Rewards for Justice (RFJ) program offers rewards of up to $5 million for information that leads to the disruption of financial mechanisms of persons engaged in certain activities that support North Korea, including money laundering, sanctions evasion, cyber-crime, and WMD proliferation,” reads the Reward for Justice website.

The list of cyber activities against financial institutions carried out by North Korea-linked hackers to generate revenues includes:

• Cyber-Enabled Financial Theft and Money Laundering
• Extortion Campaigns
• Cryptojacking

The advisory states that revenues generated through cyber activities are used by the regime for its activities, including the building of weapons of mass destruction.

The list of the cyberattacks publicly attributed to North Korean nation-state actors, includes:

• The 2014 Sony Pictures hack,
• The Bangladesh Bank Heist ($81 million),
• The 2017 WannaCry ransomware outbreak,
• FASTCash ATM attacks,
• The $250 million theft from cryptocurrency exchanges.

“Individuals and entities engaged in or supporting DPRK cyber-related activity, including processing related financial transactions, should be aware of the potential consequences of engaging in prohibited or sanctionable conduct.” concludes the advisory.

Pierluigi Paganini

(SecurityAffairs – North Korea, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]