A hacking group linked to the North Korean regime is carrying out phishing attacks targeting United Nations Security Council officials. The attacks, which the UN revealed in a report last month, have been carried out this year, targeting at least 28 UN officials, including at least 11 people representing six countries on the UN Security Council. UN officials were notified of the attacks by an unnamed UN member state. A North Korean hacking group known by the codename “Kimsuky”.
According to the UN report, Kimsuky's operations took place last March and April, including a series of spear-phishing campaigns targeting Gmail of UN officials.
The emails sent by the hacking group appeared as UN security alerts or requests for interviews from journalists, in order to induce officials to visit phishing pages or download malware files to their systems.
The country that reported that UN officials were targeted by Kimsuky's attacks also said that similar campaigns were carried out against members of its own government, with the attacks carried out not only via email but also via WhatsApp. In addition, the same country informed the UN that the North Korean hacking group targets specific individuals throughout their government careers.
The UN report also noted that this campaign had been going on for more than a year. In a similar report published in March, the UN Security Council revealed two other campaigns by Kimsuky against Council officials.
The first involved a series of phishing attacks targeting 38 email addresses associated with Security Council officials – all of whom were members of the Security Council at the time of the attack.
The second involved operations detailed in a report by France's National Cybersecurity Agency. Since August 2019, these phishing attacks have targeted officials from various countries, including China, France, Belgium, Peru and South Africa, all of whom were members of the UN Security Council at the time of the attacks.
However, these attacks did not stop in April, as stated in the most recent UN report on North Korea, but Kimsuky continued to target the UN, seeking to obtain information for the organization's decision-making on cases involving North Korea and for possible plans to impose new sanctions against the Asian country.
Sveva Vittoria Scenarelli, a senior analyst in PwC's Threat Intelligence group who specializes in Kimsuky's operations, said most of the group's operations were spear-phishing attacks, in which hackers attempted to steal credentials for a victim's various online accounts. Other spear-phishing operations aimed to infect victims with malware.
Scenarelli spoke in more detail about Kimsuky's operations yesterday at the Virus Bulletin 2020.
