North Korean Threat Actor Compromised Numerous Organizations in South Korea, Stole

South Korean authorities have accused North Korean threat actor 'Andariel' of stealing defense technology information from numerous companies, along with approximately $400,000 worth of cryptocurrency.

North Korean hackers are often in the news due to their involvement in the cryptocurrency space and as ransomware operators. As a recent research report outlined, they've likely stolen up to $3 billion in cryptocurrency since 2017, and South Korea has been one of their main targets.

As it turns out, they've done a lot more than just target the crypto industry and are responsible for compromising many companies as well.

"The North Korean hacking organization 'Andariel' hacked domestic defense companies, stole important technical data such as anti-aircraft weapons, and money laundered the bitcoins received in exchange for ransomware through the account of a foreign woman," said the Seoul Metropolitan Police Agency.

From what the authorities revealed until now, the threat actor used a domestic server rental company to hit organizations in South Korea. The police seized domestic and foreign e-mails (server user accounts). They opened 40 investigations that showed how the hackers compromised research institutes, pharmaceutical companies, and even the organization hosting their servers. One of the affected companies had information regarding anti-aircraft weapons used in South Korea.

"The police discovered that a total of 1.2TB of files, presumed to contain important technology and data, had been stolen and notified the relevant companies, but some companies were not even aware of the damage, and some reported concerns about a decline in corporate trust that led them to contact the police," authorities also said.

The Security Investigation Support Department of the Seoul Metropolitan Police Agency is currently working with the FBI regarding overseas attacks, victims, and people involved in this campaign.