sb-au logo
Story image

North Korean criminals behind phishing attack on US power companies

12 Oct 2017

Cybercriminals connected to The North Korean Government are suspected to be behind a spear phishing campaign that targeted numerous US power companies, as part of an early-stage reconnaissance mission.

Security firm FireEye detected and stopped the phishing emails last month and the company suspects that the attacks were not necessarily indicative of an imminent cyber attack.

“We have previously detected groups we suspect are affiliated with the North Korean government compromising electric utilities in South Korea, but these compromises did not lead to a disruption of the power supply,” FireEye’s Threat Research Blog says.

While hackers with links to North Korea make up some of the most ‘prolific’ nation-state threats according to FireEye, in this case threat actors have not been spotted using anything that could compromise industrial control system networks, which regulate power supplies, and there is no evidence the threat actors have the means to do so.

However, even small attacks against power companies would be seen as a victory by Pyongyang, FireEye speculates.

North Korean-linked threat actors often target South Korea and the United States, as well as the global financial systems and other nations.

FireEye says that nation-states often use cyberespionage campaigns as a way of getting intelligence. The company has detected 20 cyber threat groups sponsored by at least four other nation states that have been targeting the energy sector.

“The few examples of disruptions to energy sector operations being caused by cyber operations required additional technical and operational steps that these North Korean actors do not appear to have taken nor have shown the ability to take,” the company says.

In December 2014, North Korean threat actors may have been behind a campaign that targeted nuclear power plants in South Korea. The campaign used wiper malware not to disable operations, but to show their power and to embarrass the South Korean Government.

FireEye says threat actors’ motivations range from espionage, sabotage and economic gain – all of which demonstrate a nation-state that is willing to violate international norms.

“Thus far, the suspected North Korean actions are consistent with a desire to demonstrate a deterrent capability rather than a prelude to an unprovoked first-strike in cyberspace; however, North Korea linked actors are bold, have launched multiple cyber attacks designed to demonstrate national strength and resolve, and have little concern for potential discovery and attribution of their operations,” FireEye explains.

FireEye suspects these attackers will remain committed to going after energy sector targets, particularly in South Korea and the United States.

Story image
Fast track your digital transformation with dynamic security services from Fortinet
Jon McGettigan, Fortinet A/NZ Regional Director, explains how enterprises can speed up their network service delivery programmes by embracing Fortinet’s dynamic security services.More
Story image
Just one click – that’s all it takes to let in cyber-crime
So how do organisations ensure that users are not compromised by simply doing their work?  The answer is surprisingly simple, writes Bufferzone Security business strategist for A/NZ Greg Wyman.More
Link image
Why it's crucial to normalise proper security training for remote working
Knowing and implementing best practices for remote security can save money, time and headaches. It starts with a quality solution to safeguard the workforce.More
Story image
Check Point acquires Odo Security to bolster remote security offering
The deal will integrate Odo’s remote access software with Check Point’s Inifinity architecture, bolstering the latter company’s remote security capabilities in a time where working and learning from home has become the norm, and looks to largely remain that way in the near future.More
Story image
Exabeam and Code42 partner up to launch insider threat solution
The solution will give customers a fuller picture of their environment, and will leverage automated incident response to obstruct insider threat before data loss occurs.More
Story image
Report: 151% increase in DDoS attacks compared to 2019
It comes as the security risk profile for organisations around the world increased in large part thanks to the COVID-19 pandemic, forcing greater reliance on cloud technology and thrusting digital laggards into quick and unsecured migrations.More