North Korean Hackers Believed to be Involved in Breach of South Korean Nuclear Institute
According to reports, a high-profile North Korean hacker group was involved in a security breach affecting a nuclear research institute located in South Korea.
According to information disclosed by South Korean members of parliament, there have been 13 instances of unauthorized access from different IP addresses. The compromised network belonged to KAERI or the Korean Atomic Energy Research Institute.
The same member of parliament claimed that a portion of the IP addresses used in the instances of unauthorized access belonged to an entity called Kimsuky. Kimsuky is the handle given to an APT group that is believed to operate out of North Korea and to work on retainer for the North Korean government. The threat actor group is believed to serve a cyber espionage role and gather intelligence from its targets.
Reports mention that the same threat group is also believed to be behind a campaign injecting malware in documents dealing with the south country's response to the Covid-19 pandemic.
Representatives of the atomic energy research institute responded to the claims made by the member of parliament, stating that an "unidentified outsider" party accessed only parts of its network. The unauthorized access took advantage of a weakness in the VPN software used by the institution.
The official statement also declared that measures have been taken to address the weakness and the institute is working with South Korean authorities to determine the exact entity that was behind the attack, as well as the scope of any possible damage that may have been inflicted.
ZDNet reports that the institute did not respond to any inquiries about further comments on the incident.
Weaknesses in VPN networks that do not have multi-factor authentication or exhibit some other security flaws have led to one of the biggest ransomware attacks in recent months. The ransomware attack on Colonial Pipeline in the US was executed thanks to the threat actors getting their hands on a single functional VPN password.
North Korean Kimsuky APT was also the actor behind a cyber attack carried out in 2014, targeting South Korea's nuclear and hydro energy facility, a subsidiary of the country's largest national electric power utility.
This is just the latest incident in a long chain of attacks that are commonly ascribed to North Korean state-sponsored threat actors targeting South Korean institutions and facilities.
