Kudelski Security and Sekoia's recent study identifies six distinct clusters within North Korean cyber operations, previously grouped under the Lazarus Group.
A recent study by Kudelski Security and Sekoia has shed light on the complex web of North Korean cyber operations, revealing six specific clusters that have previously been generalized under the moniker of the Lazarus Group.
The research highlights that North Korea's cyber activities extend far beyond the Lazarus label, encompassing various operations including espionage, financial fraud, and the deployment of fake IT workers. This reclassification is crucial due to the ongoing restructuring and specialization within North Korean cyber units, which has made it difficult to differentiate between the various groups.
New Classification Framework
The study identifies six distinct clusters: TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima. These clusters are categorized based on their operational tactics, tools, and target types, marking a departure from the previously singular classification approach. This system has been created by Kudelski Security and Sekoia, rather than being an official designation of North Korean cyber entities.
Financial Motivation and Cryptocurrency Targeting
Between 2018 and 2023, significant shifts in the Lazarus operations were noted, particularly in relation to the growing cryptocurrency market. Acknowledged for its focus on financial gain, the cluster APT38 has now been categorized into two separate entities, CryptoCore and Jade Sleet, both of which primarily engage in financially motivated cyber activities.
“These two clusters focus exclusively on financially motivated campaigns, likely aimed at generating revenue for the regime,” the report suggests.
IT Employment Schemes
Another intriguing cluster, Famous Chollima, highlights North Korean IT workers securing employment in foreign firms using fraudulent identities. This strategy not only generates foreign currency income through salaries but may also serve as a method for intelligence-gathering, as these workers could access sensitive corporate information.
Kudelski Security's findings emphasize the blurred lines between earning income and espionage, noting that some IT workers might engage in cyber operations while employed, using the same network infrastructure for multiple purposes.
Espionage and Ransomware Activity
The analysis further indicates that numerous intelligence-driven clusters are simultaneously conducting operations aimed at revenue generation. For example, Moonstone Sleet has utilized ransomware tactics through its operations known as FakePenny and subsequently transitioned to a model involving Qilin, showcasing a convergence between state-sponsored cyber operations and criminal ransomware services.
The researchers assert that these cyber strategies serve multiple functions for North Korea, including intelligence collection, financial support for the regime, and evasion of international sanctions. The report highlights a shift in tactics observed since the mid-2010s, which have included bank heists and extensive cryptocurrency thefts.
Furthermore, a recent documentary revealed the extensive network of North Korean IT workers infiltrating American companies, with a single group applying to over 1,000 companies within just three months.
