On a Sunday before the start of a long-planned allied military drill, South Korean police disclosed that a campaign of suspicious emails had reached the contractors who support the joint simulation centre used by Seoul and Washington. The attempt bears the marks of Kimsuky, a group whose patient, deceptive messages have become a familiar pattern in the quiet wars fought over information on the peninsula. Investigators found that the trail led back to an address used in a 2014 breach of a nuclear reactor operator, an echo that lends the case weight even as its reach appears to have stopped shor
North Korean-Linked Hackers Target U.S.-South Korea Military Drills, Police Say
Not the military itself, but the contractors who keep the drills running
Mark
So who was actually hit here?
Mimi
Contractors working at the South Korea-U.S. combined exercise war simulation centre. They got emails, and police say those emails were the hackers' way in.
Mark
Why go after contractors rather than the military itself?
Mimi
The source doesn't say what the hackers intended. But spear-phishing works by tricking an individual into giving up a password or opening a link, so people at the edges of a system are the natural recipients.
Luke
Careful, though. That's a reading of the method, not something police stated about motive.
Mark
Fair. What's the evidence tying this to North Korea?
Mimi
Police and the U.S. military investigated jointly and found the IP address matched one from a 2014 hack on South Korea's nuclear reactor operator. Seoul blamed North Korea for that one.
Luke
Worth noting that's an IP match plus a link to Kimsuky. The group is described as North Korean by researchers, and police say the hackers were 'believed' linked. The word is suspected, not proven. And North Korea has denied involvement in cyberattacks before.
Mark
And the claim that nothing was stolen?
Luke
That's the police's confirmation, and it's the only source we have. It covers military-related information. The source doesn't say whether contractor credentials or other data were taken.
Mimi
Which is the open question as the drills begin Monday.
O Pulso
- Suspicious emails slipped toward contractors just as a major allied military exercise was preparing to open.
- Police moved quickly to announce the intrusion, signalling that the threat was taken seriously across the alliance.
- Investigators tied the attack's address to a 2014 breach of a nuclear reactor operator, pointing toward a familiar actor.
- Officials say no classified or military information was taken, and the 11-day drills are set to proceed as planned.
On a Sunday before the start of a long-planned allied military drill, South Korean police disclosed that a campaign of suspicious emails had reached the contractors who support the joint simulation centre used by Seoul and Washington. The attempt bears the marks of Kimsuky, a group whose patient, deceptive messages have become a familiar pattern in the quiet wars fought over information on the peninsula. Investigators found that the trail led back to an address used in a 2014 breach of a nuclear reactor operator, an echo that lends the case weight even as its reach appears to have stopped short of anything secret. It is one more reminder that on the Korean peninsula, conflict is increasingly waged through inboxes as well as through armies.
On Sunday, South Korean police announced that suspected North Korean hackers had targeted the people who help keep a joint U.S.-South Korea military exercise running. The drills, called Ulchi Freedom Guardian, were set to begin the next day, and police said no classified material had been obtained.
The Gyeonggi Nambu Provincial Police Agency said attackers had sent emails to South Korean contractors working at the combined exercise war simulation centre. Police confirmed that military-related information had not been stolen.
Researchers link the operation to Kimsuky, a North Korean group known for spear-phishing, the practice of crafting messages to trick a specific person into opening a file or clicking a malicious link. North Korea has denied involvement in past cyberattacks. Police, working with the U.S. military, also matched the attack's IP address to one used in a 2014 hack on South Korea's nuclear reactor operator, which Seoul blamed on Pyongyang.
The drill, an 11-day summer exercise, is meant to sharpen allied responses to North Korea's nuclear and missile threats. Pyongyang calls such exercises rehearsals for an invasion. The attack's focus on contractors rather than military networks is the notable detail, and what remains to be seen is whether more such activity emerges during the drills and whether Seoul or Washington formally attributes the attack to North Korea.
On Sunday, South Korean police announced that suspected North Korean hackers had gone after the people who keep a joint U.S.-South Korea military exercise running. The drills, called Ulchi Freedom Guardian, were due to begin the next day. Police said the hackers did not get at any classified material.
The statement came from the Gyeonggi Nambu Provincial Police Agency. According to the agency, the attackers sent emails to South Korean contractors who work at the South Korea-U.S. combined exercise war simulation centre. Police said they confirmed that military-related information was not stolen.
The hackers are believed to be tied to a North Korean group that researchers call Kimsuky. Researchers say the group has long relied on spear-phishing: emails written to trick a specific target into handing over a password, opening an attachment, or clicking a link that loads malware. The contractors at the simulation centre were the recipients in this case. North Korea has denied any role in cyberattacks in the past.
The police did not rely on the group's reputation alone. South Korean police and the U.S. military carried out a joint investigation, and they found that the IP address used in this hacking attempt matched one identified in a 2014 hack against South Korea's nuclear reactor operator. South Korea accused North Korea of being behind that earlier attack.
The exercise itself is an 11-day summer drill, starting Monday, in which South Korean and U.S. forces work to sharpen their ability to respond to North Korea's evolving nuclear and missile threats. North Korea objects to such exercises. Pyongyang says they are rehearsals by the United States and its South Korean ally for an invasion of the North.
The reported target is worth noticing. The attempt was not aimed at military networks directly but at contractors who support the simulation centre, a route that email-based campaigns like Kimsuky's are built to exploit. Police say it did not yield stolen military information.
What to watch now is whether more cyber activity turns up against allied defense contractors while the drills run, and whether Seoul or Washington goes beyond the police findings with a formal public attribution of the attack to North Korea.
Citações Notáveis
It was confirmed that military-related information was not stolen.— Gyeonggi Nambu Provincial Police Agency statement
Quer a matéria completa?
Leia o original em Devdiscourse ↗
War & Conflict