North Korean APT43 Group Uses Cybercrime to Fund Espionage Operations

Mar 29, 2023Ravie LakshmananCyber Threat / Espionage

A new North Korean nation-state cyber operator has been
attributed to a series of campaigns orchestrated to gather
strategic intelligence that aligns with Pyongyang’s geopolitical
interests since 2018.

Google-owned Mandiant, which is tracking the activity cluster
under the moniker APT43, said the group’s motives
are both espionage- and financially-motivated, leveraging
techniques like credential harvesting^[1]
and social engineering.

The monetary angle to its attack campaigns is an attempt on the
part of the threat actor to generate funds to meet its “primary
mission of collecting strategic intelligence.”

Victimology patterns suggest that targeting is focused on South
Korea, the U.S., Japan, and Europe, spanning government, education,
research, policy institutes, business services, and manufacturing
sectors.

The threat actor was also observed straying off course by
striking health-related verticals and pharma companies from October
2020 through October 2021, underscoring its ability to swiftly
change priorities.

“APT43 is a prolific cyber operator that supports the interests
of the North Korean regime,” Mandiant researchers said^[2]
in a detailed technical report published Tuesday.

“The group combines moderately-sophisticated technical
capabilities with aggressive social engineering tactics, especially
against South Korean and U.S.-based government organizations,
academics, and think tanks focused on Korean peninsula geopolitical
issues.”

APT43’s activities are said to align with the Reconnaissance
General Bureau (RGB), North Korea’s foreign intelligence agency,
indicating tactical overlaps with another hacking group dubbed
Kimsuky^[3]
(aka Black Banshee, Thallium, or Velvet Chollima).

What’s more, it has been observed using tools previously
associated with other subordinate adversarial syndicates within
RGB, such as the Lazarus Group^[4]
(aka TEMP.Hermit).

Attack chains mounted by APT43 involve spear-phishing emails
containing tailored lures to entice victims. These messages are
sent using spoofed and fraudulent personas that masquerade as key
individuals within the target’s area of expertise to gain their
trust.

It’s also known to take advantage of contact lists stolen from
compromised individuals to identify more targets and steal
cryptocurrency to fund its attack infrastructure. The stolen
digital assets are then laundered using hash rental^[5]
and cloud mining services to obscure the forensic trail and convert
them into clean cryptocurrency.

The ultimate goal of the attacks is to facilitate credential
collection campaigns through domains that mimic a wide range of
legitimate services and use the gathered data to create online
personas.

“The prevalence of financially-motivated activity among North
Korean groups, even among those which have historically focused on
cyber espionage, suggests a widespread mandate to self-fund and an
expectation to sustain themselves without additional resourcing,”
Mandiant said.

APT43’s operations are actualized through a large arsenal of
custom and publicly available malware such as LATEOP^[6]
(aka BabyShark), FastFire^[7], gh0st RAT, Quasar RAT,
Amadey^[8], and an Android version
of a Windows-based downloader called PENCILDOWN.

The findings come less than a week after German and South Korean
government agencies warned^[10] about cyber attacks
mounted by Kimsuky using rogue browser extensions to steal users’
Gmail inboxes.

“APT43 is highly responsive to the demands of Pyongyang’s
leadership,” the threat intelligence firm said, noting the group
“maintains a high tempo of activity.”

“Although spear-phishing and credential collection against
government, military, and diplomatic organizations have been core
taskings for the group, APT43 ultimately modifies its targeting and
tactics, techniques and procedures to suit its sponsors, including
carrying out financially-motivated cybercrime as needed to support
the regime.”