North Korean Hackers Launch New Cyber Assault on South Korea

South Korean security researchers have uncovered a widespread cyberattack campaign by a subgroup of the notorious North Korean “ScarCruft” threat actor that is actively infecting organizations across South Korea and the region with ransomware.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

The subgroup – dubbed “ChinopuNK” – launched the campaign in July using phishing emails and malware designed to log keystrokes, capture microphone recordings and extract data from removable devices. The attack used a malicious shortcut file hidden inside a compressed RAR archive that triggered an AutoIt loader and pulled in additional malware – including a stealer, ransomware and a backdoor – from an external server, according to S2W’s threat intelligence center.

Researchers at the South Korean data analytics and artificial intelligence firm said in an August report that the campaign “demonstrates a clear advancement in ScarCruft’s operational capabilities,” noting that the use of ransomware and a backdoor exploit “are particularly noteworthy, as these techniques have been rarely observed in their historical activity.” The North Korean hacking group, first identified in 2016, has mainly targeted defectors, journalists covering Pyongyang and government entities in Seoul.

While the group initially targeted South Korean victims, researchers said its operations have since expanded to other countries including Japan, Vietnam, Russia, Nepal and several in the Middle East. The use of ransomware signals “a notable deviation” from its traditional focus on cyberespionage to financially motivated attacks – or an expanded mission that now includes disruptive or extortion-based tactics.

Researchers advise organizations to routinely examine URLs, file hashes and other indicators for potential breaches and refine their detection systems using behavior-based rules that reflect the threat group’s tactics, techniques and procedures.

Researchers also recommend ongoing surveillance for related campaigns by analyzing infrastructure trends, code language choices and behavioral markers tied to ScarCruft’s past activity.

North Korean state-sponsored hackers have steadily advanced their cyber capabilities in recent years, conducting a broad range of espionage and financially motivated attacks to project power and fund the Hermit Kingdom’s military and weapons programs. Pyongyang’s hacking groups have also become more agile since the COVID-19 pandemic, forming temporary task forces to execute attacks – a tactic that mirrors more sophisticated operations by China and other nation-state groups (see: Researchers: North Korean Hackers Gain Speed, Flexibility).