Advancing UK Aerospace, Defence, Security & Space Solutions Worldwide
  • Home
  • /
  • Security
  • /
  • NCSC and partners warn of DPRK-sponsored cyber ops

Security

NCSC and partners warn of DPRK-sponsored cyber ops

The National Cyber Security Centre (NCSC) – a part of GCHQ – issued a new advisory yesterday alongside partners in the US and the Republic of Korea, which reveals how a Democratic People’s Republic of Korea (DPRK) sponsored cyber threat group known as Andariel, has been compromising organisations around the world to steal sensitive and classified technical information and intellectual property data.

Image copyright Shutterstock

The NCSC assesses that Andariel is a part of DPRK’s Reconnaissance General Bureau (RGB) 3rd Bureau and that the group’s malicious cyber activities pose an ongoing threat to critical infrastructure organisations globally.  

The cyber actors have primarily targeted defence, aerospace, nuclear and engineering entities and organisations in the medical and energy sectors to a lesser extent, in order to obtain information such as contract specification, design drawings and project details.

Advertisement
ODU RT

As part of its operations, Andariel has also launched ransomware attacks against US healthcare organisations in order to extort payments and fund further espionage activity.

This advisory shares technical details and mitigation advice to help defend against the actors who have been seen exploiting known vulnerabilities to access victims’ systems before deploying malware and other tools to maintain persistence, evade detection and exfiltrate data.  

Paul Chichester, NCSC Director of Operations, said: “The global cyber espionage operation that we have exposed today shows the lengths that DPRK state-sponsored actors are willing to go to pursue their military and nuclear programmes.

“It should remind critical infrastructure operators of the importance of protecting the sensitive information and intellectual property they hold on their systems to prevent theft and misuse.  

“The NCSC, alongside our US and Korean partners, strongly encourage network defenders to follow the guidance set out in this advisory to ensure they have strong protections in place to prevent this malicious activity.”

Advertisement
ODU RT

The advisory outlines how Andariel has evolved its operations from conducting destructive attacks targeting US and South Korea organisations to conducting specialised cyber espionage and ransomware attacks.

It warns that in some cases the actors have even been observed launching ransomware attacks and espionage operations on the same day and leveraging both activities against the same victim.

The advisory has been co-sealed by the NCSC, the US Federal Bureau of Investigation (FBI), the US Cyber National Mission Force (CNMF), the US Cybersecurity and Infrastructure Security Agency (CISA), the US Department of Defense Cyber Crime Center (DC3), the US National Security Agency (NSA), the Republic of Korea’s National Intelligence Service (NIS) and the Republic of Korea’s National Police Agency (NPA).

It can be read on the FBI website: www.ic3.gov/Media/News/2024/240725.pdf
 

Advertisement
Roke Roke
Axon introduces new products and partnerships

Security

Axon introduces new products and partnerships

24 April 2025

Axon has introduced a number of new products and partnerships, expanding its real-time network and public safety ecosystem.

Heathrow Airport extends partnership with Safe365

Aerospace Security

Heathrow Airport extends partnership with Safe365

23 April 2025

Heathrow Airport has renewed its commitment to workplace and passenger safety by extending its partnership with Safe365 - a New Zealand-based safety technology company - for a further three years, which was witnessed in a ceremony attended by New Zealand Prime Minister Christopher Luxon.

Independent review turns to tackling Britain’s biggest crime

Security

Independent review turns to tackling Britain’s biggest crime

23 April 2025

Better protections for the British public against fraud, and tougher enforcement against the perpetrators, will be the goals of the first independent review carried out in 40 years into the UK’s fraud laws.

Unifi secures Oxford Airport ground handling and security contracts

Aerospace Security

Unifi secures Oxford Airport ground handling and security contracts

17 April 2025

Unifi has secured its first business aviation ground handling contract and its third Fixed Base Operation/FBO security contract in the UK at London Oxford Airport, marking a major expansion of its services and a new milestone in its global growth.

Advertisement
DSEI 2025
M Group acquires Telent

Defence Security

M Group acquires Telent

16 April 2025

M Group has aquired Telent, a provider of operational technology and digital solutions for Critical National Infrastructure (CNI) across the UK and Ireland.

Met brings leader of fraud platform to justice 

Security

Met brings leader of fraud platform to justice 

15 April 2025

A massive worldwide operation led by the Met has seen a prolific cyber-criminal sent to prison for eight-and-a-half years.

Advertisement
DSEI 2025