lazarusholicJul 9, 2025
"Sanctions Imposed on DPRK IT Workers Generating Revenue for the Kim Regime" published by USTreasury. #Sanctions, #Andariel, #ITWorker, #DPRK, #CTI https://home.treasury.gov/news/press-releases/sb0190
Sanctions Imposed on DPRK IT Workers Generating Revenue for the Kim Regime

WASHINGTON — Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Song Kum Hyok, (Song), a malicious cyber actor associated with the sanctioned Democratic People’s Republic of Korea (DPRK) Reconnaissance General Bureau (RGB) hacking group Andariel.Song facilitated an information technology (IT) worker scheme in which individuals, often DPRK nationals working from countries such as China and Russia, were recruited and provided with falsified identities and nationalities to obtain employment at unwitting companies to generate revenue for the DPRK regime.  In some cases, these DPRK IT workers have been known to introduce malware into company networks for additional exploitation.  OFAC is also sanctioning one individual and four entities involved in a Russia-based IT worker scheme that has generated revenue for the DPRK. “Today’s action underscores the importance of vigilance on the DPRK’s continued efforts to clandestinely fund its WMD and ballistic missile programs,” said Deputy Secretary of the Treasury Michael Faulkender.  “Treasury remains committed to using all available tools to disrupt the Kim regime’s efforts to circumvent sanctions through its digital asset theft, attempted impersonation of Americans, and malicious cyber-attacks.”Today’s designation is part of the U.S. government’s objective to counter the DPRK’s efforts to advance its strategic goals through cyber espionage and revenue generation.  On March 2, 2016, the United Nations Security Council (UNSC) adopted Resolution 2270 designating the RGB for its role supporting the Kim regime’s unlawful weapons development.  Today’s action reaffirms that relevant UNSC resolutions remain in full force.  On September 13, 2019, OFAC designated the Lazarus Group, Bluenoroff, and Andariel:  all DPRK-sponsored cyber groups subordinate to the RGB, which have carried out numerous high-value virtual currency heists to offset the impact of U.S. and multilateral sanctions.  Additionally, on May 23, 2023, OFAC designated the Technical Reconnaissance Bureau, which leads the DPRK’s development of offensive cyber tactics and tools, and its subordinate cyber unit, the 110th Research Center.Illicit DPRK IT Worker SchemeSThe DPRK generates significant revenue through the deployment of IT workers who fraudulently gain employment with companies around the world, including in the technology and virtual currency industries.  The DPRK maintains a workforce of thousands of highly skilled IT workers globally, primarily located in the People’s Republic of China and Russia, who generate significant revenue that contributes to its WMD and ballistic missile programs.These workers are instructed to deliberately obfuscate their identities, locations, and nationalities, typically using false personas, proxy accounts, stolen identities, and falsified or forged documentation to apply for jobs at these companies.  They target employers located in wealthier countries, utilizing a variety of mainstream and industry-specific freelance contracting, payment, and social media and networking platforms.  Applications and software developed by DPRK IT workers span a range of fields and sectors, including business, health and fitness, social networking, sports, entertainment, and lifestyle.  DPRK IT workers often take on projects that involve virtual currency, and they use virtual currency exchanges and trading platforms to manage funds they receive for contract work as well as to launder and remit these funds to the DPRK.KEY FACILIATOR FOR KIM REGIME’S OVERSEAS IT WORKFORCESong is a DPRK-based cyber actor who used foreign-hired IT workers to seek remote employment with U.S. companies and planned to split income with them.  In 2022 and 2023, Song used U.S. persons’ information, including names, social security numbers, and addresses to create aliases for the hired foreign workers.  The workers then used the accounts to pose as U.S. persons looking for remote jobs with U.S. companies.Song is being designated pursuant to Executive Order (E.O.) 13694, as further amended by E.O. 14306, for being responsible for or complicit in, or having engaged in, directly or indirectly, the receipt or use for commercial or competitive advantage or private financial gain, or by a commercial entity, outside the United States of funds or economic resources, intellectual property, proprietary or business confidential information, personal identifiers, or financial information misappropriated through cyber-enabled means, knowing they have been misappropriated, where the misappropriation of such funds or economic resources, intellectual property, proprietary or business confidential information, personal identifiers, or financial information is reasonably likely to result in, or has materially contributed to, a threat to the national security, foreign policy, or economic health or financial stability of the United States.ASATRYAN IT WORKER NETWORK Gayk Asatryan (Asatryan), a Russian national, has used his Russia-based companies to employ North Korean IT workers.  In mid-2024, Asatryan signed a 10-year contract with a DPRK company, Korea Songkwang Trading General Corporation (Songkwang Trading), to dispatch up to 30 DPRK IT workers to work in Russia for his company, Asatryan Limited Liability Company (Asatryan LLC).  Asatryan also signed a contract with DPRK company Korea Saenal Trading Corporation (Saenal Trading), in which they planned to dispatch 50 DPRK IT workers to Russia for his company, Fortuna Limited Liability Company (Fortuna LLC).OFAC designated Asatryan pursuant to E.O. 13722 for having attempted to engage in, facilitate, or be responsible for the exportation of workers from North Korea, including exportation to generate revenue for the Government of North Korea or Workers’ Party of Korea.  Asatryan LLC and Fortuna LLC are designated pursuant to E.O. 13722 for being owned or controlled by or acting or purporting to act for or on behalf of, directly or indirectly, Asatryan, a person whose property and interests in property are blocked pursuant to E.O. 13722.  Songkwang Trading and Saenal Trading are designated pursuant to E.O. 13810 for being North Korean persons, including North Korean persons that have engaged in commercial activity that generates revenue for the Government of North Korea or Workers’ Party of Korea.SANCTIONS IMPLICATIONS As a result of today’s action, all property and interests in property of the designated or blocked persons described above that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC.  In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. Unless authorized by a general or specific license issued by OFAC, or exempt, OFAC’s regulations generally prohibit all transactions by U.S. persons or within (or transiting) the United States that involve any property or interests in property of blocked persons. Violations of U.S. sanctions may result in the imposition of civil or criminal penalties on U.S. and foreign persons.  OFAC may impose civil penalties for sanctions violations on a strict liability basis.  OFAC’s Economic Sanctions Enforcement Guidelines provide more information regarding OFAC’s enforcement of U.S. economic sanctions. In addition, financial institutions and other persons may risk exposure to sanctions for engaging in certain transactions or activities involving designated or otherwise blocked persons. The prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any designated or blocked person, or the receipt of any contribution or provision of funds, goods, or services from any such person. The power and integrity of OFAC sanctions derive not only from OFAC’s ability to designate and add persons to the Specially Designated Nationals and Blocked Persons List (SDN List), but also from its willingness to remove persons from the SDN List consistent with the law. The ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior.  For information concerning the process for seeking removal from an OFAC list, including the SDN List, or to submit a request, please refer to OFAC’s guidance on Filing a Petition for Removal from an OFAC List.For more information on the individuals and entity designated today, click here.To read the DPRK IT Workers Advisory, click here. 

U.S. Department of the Treasury
lazarusholicApr 24, 2025
"Ransomware’s New Masters: How States Are Hijacking Cybercrime" published by VirtualRoutes. #Andariel, #Ransomware, #DPRK, #CTI https://virtual-routes.org/pharos-report-no-3-ransomwares-new-masters-how-states-are-hijacking-cybercrime/
Pharos Report No. 3: Ransomware’s New Masters: How States Are Hijacking Cybercrime - Virtual Routes

The third report in the Pharos Series, Ransomware’s New Masters: How States Are Hijacking Cybercrime is authored by Aleksandar Milenkoski, Jiro Minier, Julian-Ferdinand Vögele, Max Smeets, and Taylor Grossman.

Virtual Routes
ESET ResearchMar 26, 2025
#ESETresearch discovered previously unknown links between the #RansomHub, #Medusa, #BianLian, and #Play ransomware gangs, and leveraged #EDRKillShifter to learn more about RansomHub’s affiliates. @SCrow357 https://www.welivesecurity.com/en/eset-research/shifting-sands-ransomhub-edrkillshifter/
RansomHub emerged in February 2024 and in just three months reached the top of the ransomware ladder, recruiting affiliates from disrupted #LockBit and #BlackCat. Since then, it dominated the ransomware world, showing similar growth as LockBit once did.
Previously linked to North Korea-aligned group #Andariel, Play strictly denies operating as #RaaS. We found its members utilized RansomHub’s EDR killer EDRKillShifter, multiple times during their intrusions, meaning some members likely became RansomHub affiliates.
BianLian focuses on extortion-only attacks and does not publicly recruit new affiliates. Its access to EDRKillShifter suggests a similar approach as Play – having trusted members, who are not limited to working only with them.
Medusa, same as RansomHub, is a typical RaaS gang, actively recruiting new affiliates. Since it is common knowledge that affiliates of such RaaS groups often work for multiple operators, this connection is to be expected.
Our blogpost also emphasizes the growing threat of EDR killers. We observed an increase in the number of such tools, while the set of abused drivers remains quite small. Gangs such as RansomHub and #Embargo offer their killers as part of the affiliate program.
IoCs available on our GitHub: https://github.com/eset/malware-ioc/tree/master/ransomhub
Shifting the sands of RansomHub’s EDRKillShifter

ESET researchers discover new ties between affiliates of RansomHub and of rival gangs Medusa, BianLian, and Play.

GraylogMar 6, 2025

Let's take a look at how RID hijacking and hidden backdoor accounts work in the #Andariel threat group's attack chain. ☠️ ⛓️‍💥 Plus, see how #Graylog Security can be used to detect and analyze similar activity in an organization’s network. 🔍

Learn about:
✔️ What RID hijacking is
✔️ The details of a RID hijacking attack
✔️ Custom and open-source tooling
✔️ Attempts to hide users
✔️ Detections
...and more.

https://graylog.org/post/adversary-tradecraft-a-deep-dive-into-rid-hijacking-and-hidden-users/?utm_content=324605357&utm_medium=social&utm_source=linkedin&hss_channel=lcp-2783090 #cybersecurity #threatactors

Adversary Tradecraft: A Deep Dive into RID Hijacking and Hidden Users

Take a look at this deep dive into RID Hijacking and Hidden Users and the detections in Graylog to find these Adversaries.

Graylog
GraylogFeb 12, 2025

The #Andariel threat group, a DPRK state-sponsored APT active for over a decade, has been leveraging RID hijacking and user account concealment techniques in its operations to stealthily maintain privileged access to compromised Windows systems. 😱

Learn (hands-on!) how RID hijacking and hidden backdoor accounts work in Andariel’s attack chain, and how you can detect and analyze similar activity in your organization’s network. 🔍 👀

https://graylog.org/post/adversary-tradecraft-a-deep-dive-into-rid-hijacking-and-hidden-users/ #security #cybersecurity #GraylogLabs

Adversary Tradecraft: A Deep Dive into RID Hijacking and Hidden Users

Take a look at this deep dive into RID Hijacking and Hidden Users and the detections in Graylog to find these Adversaries.

Graylog
lazarusholicJan 24, 2025
"RID Hijacking Technique Utilized by Andariel Attack Group" published by Ahnlab. #Andariel, #DPRK, #CTI https://asec.ahnlab.com/en/85942/
RID Hijacking Technique Utilized by Andariel Attack Group - ASEC

AhnLab SEcurity intelligence Center (ASEC) has identified the Andariel attack group using a malicious file to perform an RID Hijacking attack during the breach process.    RID Hijacking is an attack technique that involves modifying the Relative Identifier (RID) value of an account with restricted privileges, such as a regular user or guest account, to […]

ASEC
lazarusholicJan 23, 2025
"Andariel 공격 그룹이 활용하는 RID Hijacking 공격 기법" published by Ahnlab. #Andariel, #DPRK, #CTI https://asec.ahnlab.com/ko/85920/
Andariel 공격 그룹이 활용하는 RID Hijacking 공격 기법 - ASEC

ASEC(AhnLab SEcurity intelligence Center)은 Andariel 공격 그룹이 침해 과정에서 악성 파일을 이용해 RID Hijacking 공격을 수행하는 것을 확인했다.    RID Hijacking은 일반 사용자나 게스트 계정과 같이 제한된 권한을 가진 계정의 RID(상대 식별자)값을 관리자와 같이 높은 권한을 가진 계정의 RID 값으로 변조하는 공격 기법이다. 한국인터넷진흥원에서 공개한 “TTPs #11: Operation An Octopus – 중앙 집중형 관리 솔루션을 […]

ASEC
lazarusholicJan 21, 2025
"Analysis of Attack Strategies Targeting Centralized Management Solutions" published by KRCERT. #AnOctopus, #Andariel, #Slides, #DPRK, #CTI https://jsac.jpcert.or.jp/archive/2025/pdf/JSAC2025_1_7_dongwook-kim_seulgi-lee_en.pdf
lazarusholicJan 21, 2025
"An exploratory analysis of the DPRK cyber threat landscape using publicly available reports" published by lazarusholic. #Andariel, #BlueNoroff, #Kimsuky, #Konni, #Lazarus, #ScarCruft, #DPRK, #CTI https://link.springer.com/article/10.1007/s10207-025-00980-x
An exploratory analysis of the DPRK cyber threat landscape using publicly available reports - International Journal of Information Security

Cyber activities have evolved to mirror real-world operations, prompting state-sponsored intelligence agencies to pivot swiftly to cyberspace. Notably, Democratic People’s Republic of Korea (DPRK) state-sponsored threat actors have emerged as significant global players, targeted not only the Republic of Korea but also engaged in espionage activities worldwide. Their activities have expanded to include ransomware distribution and cryptocurrency heists, indicating a pursuit of financial gain. To comprehensively understand and track their activities, the research utilized exploratory analysis of publicly available reports. This research involved meticulous analysis of over 2000 publicly available reports spanning a significant period from 2009 to May 2024. Our analysis focused on identifying the code names employed in these reports to denote DPRK state-sponsored threat actors. By analyzing the naming conventions used by cyber threat intelligence companies, the study clustered groups believed to represent the same entity. This approach identified 160 distinct code names for these actors. Additionally, the threat actors were categorized into seven widely recognized groups in the threat intelligence industry. Furthermore, 154 notable incidents attributed to these actors were extracted and documented. Detailed analysis of these incidents, including motivations, targeted sectors, and related factors, provided valuable insights into the evolving tactics of DPRK state-sponsored threat actors. In a concerted effort to contribute to the cybersecurity community, our findings have been openly shared as a dataset and presented through a dedicated website for easy access. This initiative aims to significantly enhance the understanding of researchers interested in their activities. The dataset, now publicly available, serves as a valuable resource for researchers seeking comprehensive material on their activities. Openly sharing the findings aims to foster collaboration and further research in the cybersecurity community to effectively combat emerging threats.

SpringerLink
lazarusholicJan 2, 2025
"AhnLab EDR을 활용한 Play 랜섬웨어 공격 사례 탐지" published by Ahnlab. #Andariel, #Play, #Ransomware, #DPRK, #CTI https://asec.ahnlab.com/ko/85444/
AhnLab EDR을 활용한 Play 랜섬웨어 공격 사례 탐지 - ASEC

Play 랜섬웨어는 Balloonfly 또는 PlayCrypt라고도 불리며 2022년 6월 최초로 확인된 이후 현재까지 전 세계에서 300개 이상의 조직을 공격한 것으로 알려져 있다. 파일 암호화 이후 “.PLAY” 확장자를 추가하는 것이 특징이며 최근까지도 활발하게 활동하고 있다. 다른 랜섬웨어 공격자들과 동일하게 시스템들을 암호화하기 전에 정보를 탈취하여 피해자를 협박하며 웹 사이트에서 공격당한 업체의 리스트들을 공개한다.   Figure 1. 공개된 기업 […]

ASEC