North Korean APT45 Hackers, Long Running Digital Military Since 2009

The FBI and Google-owned Mandiant have recently revealed a sophisticated North Korean hacking group known as APT45. This group, previously dubbed Andariel, has been conducting cyber espionage campaigns globally since at least 2009.

It has now been elevated to an Advanced Persistent Threat (APT) status, signifying its high skill and resourcefulness in infiltrating systems and stealing sensitive data.

APT45’s operations have primarily targeted U.S. government agencies, defense industrial bases, and critical infrastructure. The group has shown interest in information stored in government nuclear facilities, research institutes, and data on uranium processing, nuclear power plants, and radar systems. These targets align closely with North Korea’s efforts to bolster its military apparatus and nuclear missile program.

Michael Barnhart, a principal analyst at Mandiant, succinctly described APT45’s role: “When Kim Jong Un demands better missiles, these are the guys who steal the blueprints for him.” This underscores the group’s significance in North Korea’s cyber warfare strategy.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.

While initially focused on espionage, APT45 has expanded its operations to include financially motivated attacks, particularly ransomware. These attacks have targeted healthcare providers, financial institutions, and energy companies. This dual focus on both intelligence gathering and financial gain has become a hallmark of North Korean cyber operations.

APT45’s ransomware strategy has evolved significantly over the years, marked by a shift from espionage to financially motivated operations, a broadening of targets, and increased sophistication. The group’s use of off-the-shelf ransomware, cryptocurrency, and suspected links to the North Korean regime highlights the complexity and severity of the threat posed by APT45.

Mandiant assesses with high confidence that APT45 is a state-sponsored cyber operator working under the direction of North Korea’s Korean People’s Army. The group is believed to answer to the nation’s Reconnaissance General Bureau, serving as both an espionage unit and a financially motivated cyber operator.

Following are the countries the APT45 group attacked;

The impact of APT45’s activities extends beyond mere data theft. U.S. assessments suggest that the cyber enterprise has funded approximately 50% of North Korea’s missile projects, highlighting the critical role of these digital operations in supporting the regime’s nuclear ambitions.

In 2022, the U.S. Cybersecurity and Infrastructure Security Agency reported that North Korean state-sponsored actors used MAUI ransomware to target the healthcare and public health sectors. In 2021, Kaspersky reported that ransomware identified as SHATTEREDGLASS, tracked by Mandiant, has been used by suspected APT45 clusters.

Below is a detailed overview of their most recent targets based on the latest reports:

Healthcare Sector

APT45 has been targeting healthcare providers with ransomware attacks, particularly since the onset of the COVID-19 pandemic. These attacks involve stealing sensitive data and demanding ransom payments for its return.

Financial Institutions

The group has expanded its ransomware operations to include financial institutions, aiming to generate revenue for the North Korean regime.

Energy Sector

APT45 has targeted energy companies, focusing on disrupting operations and stealing valuable data.

Critical Infrastructure

• Nuclear Facilities: The group has targeted nuclear research facilities and power plants, including the Kudankulam Nuclear Power Plant in India. These attacks are part of their broader strategy to support North Korea’s nuclear ambitions.
• Government Nuclear Facilities: APT45 has targeted information stored in U.S. government nuclear facilities and research institutions, focusing on data related to uranium processing, enrichment, and missile systems.

Defense and Military Targets

• Weapons Systems and Blueprints: The group has stolen sensitive information and blueprints related to various weapon systems, including tanks, submarines, torpedoes, unmanned underwater vehicles (UUVs), and autonomous underwater vehicles (AUVs).
• South Korean Defense Companies: APT45 has infiltrated networks of South Korean defense companies, stealing information about anti-aircraft weapon systems and other military technologies.

Other Sectors

• Crop Science Division: The group targeted the crop science division of a multinational corporation in 2020, indicating a broader interest in intellectual property theft beyond traditional defense and financial targets.

As North Korea continues to improve its cyber abilities, APT45 is a significant and ongoing threat to global cybersecurity. The group can change its methods and broaden its targets, making it a strong opponent in the digital world.

Because of ongoing geopolitical tensions, the actions of APT45 and similar North Korean cyber units will continue to be a major concern for global cybersecurity efforts.

In response to this threat, the FBI and other intelligence partners are collaborating with cybersecurity firms like Mandiant to track and thwart APT45’s operations. However, the group’s sophistication and the backing of the North Korean regime present ongoing challenges in mitigating this digital threat.

The ever-changing cyber environment highlights how APT45’s actions underscore the connection between cyber warfare sponsored by governments and worldwide security issues.

The group’s long-running operations underscore the need for continued vigilance and international cooperation in addressing the complex challenges posed by state-backed cyber threats.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo