From cryptojacking to COVID research hacking, North Korea is establishing a cybercrime blueprint that could help other rogue states to circumvent sanctions

SALT LAKE CITY--(BUSINESS WIRE)--#APT38--North Korea is successfully pioneering a new model of state-sponsored cybercrime that could create a dangerous blueprint for other rogue states to follow, researchers from Venafi^�, the inventor and leading provider of machine identity management, warned today. Venafi�s threat intelligence specialists analyzed publicly available information on North Korean-sponsored cybercriminal groups � such as Lazarus and APT38 � and their methods over the past four years to gain insights into how these groups operate � noting the differences between the actions of threat actors from a rogue state and those that are somewhat confined by international law.

Venafi researchers have concluded that cybercrime has become a primary means of revenue generation for North Korea, helping the state to work outside international sanctions. Some estimates suggest that cybercrime profits for North Korea may amount to as much as $1 billion each year. According to the UN Security Council as much $2 billion is already making its way directly into the nation�s weapons programme. In addition, funds generated by cybercrime support the North Korean economy, countering the impact of economic sanctions. As such, cybercrime is essential to the ongoing survival of the Kim Jong Un dictatorship � a regime that has been accused of widespread human rights abuses and nuclear proliferation, threatening others in the region and the wider global community.

The cybercrime model of North Korea could create a blueprint for other nations to develop similar programs. Without international action, Venafi warns that this could result in escalating cyber guerrilla warfare, putting all nations at significant risk.

�The world needs to start taking this threat more seriously,� said Yana Blachman, threat intelligence specialist at Venafi. �North Korean attacks are often more brazen and reckless than those sponsored by other states because they are not afraid of getting caught � this makes them particularly dangerous. North Korea gives the cybercriminals it sponsors free reign to engage in highly destructive, global attacks, such as the 2017 attacks on Windows users worldwide that used the WannaCry ransomware, which affected more than 200,000 users across at least 150 countries. North Korea is setting an example that other rogue states can follow; states such as Belarus and even Myanmar can see that cybercrime offers them a way of countering the worst effects of sanctions, while making themselves more of a threat to the wider community.�

North Korea sponsors criminal groups such as Lazarus and APT38 through its military-affiliated �Reconnaissance General Bureau� (RGB). These groups are known to target business and governments worldwide via methods such as ATM cashout schemes, cryptomining and cryptocurrency theft, and even cyber bank heists. For example, the $101 million heist of the Bangladesh Bank via the SWIFT banking system was carried out by North Korea. Several of these attacks are characterised by their use of code signing certificates, which serve as machine identities making it possible for businesses to trust the software they use.

�North Korea�s use of code signing machine identities makes its attacks particularly hard to defend against,� continued Blachman. �Stealing code-signing machine identities equips North Korean cybercriminals with the ability to pass off their own malicious software as legitimate software from a genuine developer. It also enables them to execute devastating supply chain attacks. The problem is that there�s currently not enough awareness and security around the importance of machine identities. This lack of focus allows North Korean cybercriminals to take advantage of a serious blindspot in software supply chain attacks. Without more co-ordination and collaboration among businesses and governments to address the tactics used by North Korean cybercriminals, these threats will only get worse, and other global pariahs will sense their own opportunities.�

For more information, please visit:

https://www.venafi.com/blog/north-korean-cyberattacks-can-inspire-other-rogue-nations

About Venafi

Venafi is the cybersecurity market leader in machine identity management, securing machine-to-machine connections and communications. Venafi protects machine identity types by orchestrating cryptographic keys and digital certificates for SSL/TLS, SSH, code signing, mobile and IoT. Venafi provides global visibility of machine identities and the risks associated with them for the extended enterprise�on premises, mobile, virtual, cloud and IoT�at machine speed and scale. Venafi puts this intelligence into action with automated remediation that reduces the security and availability risks connected with weak or compromised machine identities while safeguarding the flow of information to trusted machines and preventing communication with machines that are not trusted.

With more than 30 patents, Venafi delivers innovative solutions for the world's most demanding, security-conscious Global 5000 organizations and government agencies, including the top five U.S. health insurers; the top five U.S. airlines; the top four credit card issuers; three out of the top four accounting and consulting firms; four of the top five U.S. retailers; and the top four banks in each of the following countries: the U.S., the U.K., Australia and South Africa.

For more information, visit: www.venafi.com.

Contacts

Shelley Boose

[email protected]
408.398.6987