US Turning Up the Heat on North Korea's Cyber Threat Operations

The US government's move last Friday to slap sanctions on three North Korean cyber threat groups is being viewed by some security experts as a necessary but likely futile attempt to slow down state-sponsored hacking activity in that country.

The sanctions came amid reports of fresh threat activity targeted at US interests from North Korea. The US DHS and the FBI warned of new malware activity related to Hidden Cobra, a DDoS botnet previously linked to North Korea's intelligence apparatus. In another report, security vendor Prevailion said it had observed a recent expansion of a North Korean threat campaign dubbed 'Autumn Aperture' directed at US organizations in multiple industries.

The US Department of Treasury announced the sanctions against North Korea's Lazarus Group and two of its sub-groups Bluenoroff and Andarie. All three are accused of working for the Reconnaissance General Bureau (RGB) North Korea’s primary intelligence agency to support the country's missile and weapons programs.

Lazarus Group is best known for its involvement in the WannaCry 2.0 attacks of December 2017 and the crippling breach at Sony in 2014.  Security researchers believe Bluernoroff was established to earn money for the cash-strapped sanctions-hit North Korean government. The group has been linked to attacks on banks in Bangladesh, India, South Korea, Mexico and several other countries and is believed to have stolen tens of millions of dollars in these cyber heists. Andarie's mission is thought to be similar, though this group's attacks have focused on bankcard theft and ATM hacking.

In a statement announcing the sanctions, the Treasury Department described the three threat groups as being directly controlled by the North Korean government and being used to perpetuate the country's broader nuclear and military goals. The sanctions prohibit all dealings by US individuals and business with the three threat groups and any entities believed associated with them in a meaningful way. It also puts strictures on any properties or business deals the groups or their associates might have in the US.

The big question is whether the sanctions will have any deterrent impact considering the targeted groups are not based in the US nor are likely to have any meaningful assets or interests that can be seized here.

"Sanctions are, arguably ineffective and laughable," says Chris Roberts, chief security strategist at Attivo Networks.

US sanctions on North Korea for more than 25 years over its nuclear program have had little direct effect and it is likely the new ones against the three threat groups will do much to deter them, he says. Their business is breaking the law so merely telling them to stop will do little to change things on the ground Roberts notes. "Their tools, technologies and systems are in place, and anything they need they can readily get from the rest of the world with little difficulty."

John Hultquist, director of intelligence at FireEye, says over the past several years North Korea's cyber espionage apparatus has evolved into a significant state-run criminal enterprise. "North Korea has continuously improved their capability, especially with regards to their financially-motivated schemes, which often involve innovative tools and techniques," he says.

It's hard to judge the effectiveness of sanctions and indictments, which are two of the tools the US has attempted to leverage to alter the behavior of threat actors in other countries as well including in China, Russia, and Iran. Some, like China and Iran, have notably changed their behavior in the past, he notes. "But internal restructuring, or a warming relationship with the US may have caused the changes, rather than [sanctions]," he says.

Autumn Aperture Campaign

Meanwhile, Prevailion last week said it had observed a spike in activity related to Autumn Aperture, a cyber-espionage campaign targeting US organizations. The security vendor has linked the campaign with a moderate level of certainty to a North Korean advanced persistent threat group called Kimsuky or Smoke Screen.

Prevailion said its researchers have recently observed the threat actors behind the Autumn Aparture campaign using documents discussing North Korean nuclear deterrence and its nuclear submarine program as lures in malware-laden emails.

The documents that are being used are all legitimate documents written by industry experts. What the threat actors are doing is appending their malware to the documents and sending them out as attachments to targeted recipients—sometimes using obscure file formats such as Kodak FlashPix to evade detection.

Danny Adamitis, director of intelligence analysis at Prevailion, says with the latest campaign the threat actors have added functionality to check for the presence of various anti-virus products before downloading the secondary payload. "Prevailion assesses that the threat actor is a persistent threat that will continue to pose a threat to US based think tanks and their partners, particularly those involved in national security based upon historical targeting trends," Adamitis says.

The DHS and FBI last week also released alerts on malware activity tied to North Korea. The two agencies reported on an IP tunneling tool called ELECTRICFISH and a Trojan dubbed BADCALL that they described as being linked to the North Korean Hidden Cobra botnet.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Escaping Email: Unlocking Message Security for SMS, WhatsApp."