US Government blames nearly a decade of cyber-attacks on North Korea
North Korea has been blamed for a string of cyber-attacks stretching back to 2009 by the US Government which claims that more are likely.
The joint warning from the US Department of Homeland Security and the Federal Bureau of Investigation said that “cyber actors of the North Korean Government,” referred to in the report as “Hidden Cobra,” had targeted the media, aerospace and financial sectors, as well as critical infrastructure, in the United States and globally.
The new level of detail about the US Government’s analysis of suspected North Korean hacking activity coincides with increasing tensions between Washington and Pyongyang because of North Korea’s missile tests. The alert warned that North Korea would continue to rely on cyber operations to advance its military and strategic objectives.
North Korea has routinely denied involvement in cyber-attacks against other countries.
Despite that, it was blamed for the WannaCry cyber-attack that hit the NHS and other institutions around the world on 12 May and in 2015 a North Korean defector warned that the country’s hacking capabilities were being leveraged to destroy critical infrastructure and even kill people.
Tuesday’s alert said Hidden Cobra has been previously referred to by private sector experts as Lazarus Group and Guardians of the Peace, which have been linked to attacks such as the 2014 intrusion into Sony Corp’s Sony Pictures Entertainment.
The alert did not identify specific Hidden Cobra victims. It said the group had compromised a range of victims and that some intrusions had resulted in thefts of data while others were disruptive. The group’s capabilities include denial of service attacks, which send reams of junk traffic to a server to knock it offline, keystroke logging, remote access tools and several variants of malware, the alert said.
John Hultquist, a cyber intelligence analyst with FireEye, said that his firm was concerned about increasingly aggressive cyber-attacks from North Korea.
The hacks include cyber espionage at South Korean finance, energy and transportation firms that appears to be reconnaissance ahead of other attacks that would be disruptive or destructive, he said.
“It suggests they are preparing for something fairly significant,” he added.
Hidden Cobra commonly targets systems that run older versions of Microsoft operating systems that are no longer patched, the alert said, and also used vulnerabilities in Adobe Systems Flash software to gain access into targeted computers.
The report urged organisations to upgrade to current versions of Adobe Flash and Microsoft Silverlight or, when possible, uninstall those applications altogether.
Microsoft said it an emailed statement that it had “addressed” the Silverlight issue in a January 2016 software update. Adobe said via email that it patched the vulnerabilities in June 2016.
North Korean hacking activity has grown increasingly hostile in recent years, according to Western officials and cyber-security experts.
“The US Government seeks to arm network defenders with the tools they need to identify, detect and disrupt North Korean government malicious cyber activity that is targeting our country’s and our allies’ networks,” a DHS official said about the alert. The official was not authorised to speak publicly.