![](https://img1.daumcdn.net/relay/cafe/original/?fname=https%3A%2F%2Fimg.washingtonpost.com%2Frf%2Fimage_1484w%2F2010-2019%2FWashingtonPost%2F2018%2F02%2F20%2FForeign%2FImages%2FTEC--Protecting_Against_Ransomware_29469-06de9-5104.jpg%3Fuuid%3DKSDc1hYSEeiSyTdrT-V_9w)
Employees watch electronic boards to monitor possible ransomware cyberattacks at the Korea Internet and Security Agency in Seoul, South Korea on May 15, 2017. (Yun Dong-Jin/AP)
TOKYO — North Korea is quietly expanding both the scope and sophistication of its cyberweaponry, laying the groundwork for more devastating attacks, according to a new report published Tuesday.
Kim Jong Un’s cyberwarriors have been accused of causing huge disruption in recent years, including being blamed for the massive hack on Sony Pictures in 2014 and last year’s WannaCry ransomware worm
Now it appears that North Korea has also been using previously-unknown holes in the Internet to carry out cyberespionage — the kinds of activities that could easily metamorphose into full-scale attacks, according to a report from FireEye
Although the North Korean regime bans the internet for ordinary citizens and is decidedly behind the times with most technology, it has funneled a huge amount of time and money into building a cyberarmy capable of outsmarting more technicogically advanced countries like South Korea.
“Our concern is that this could be used for a disruptive attack rather than a classic espionage mission, which we already know that the North Koreans are regularly carrying out,” said John Hultquist, director of intelligence analysis for FireEye.
FireEye said that it has “high confidence” that a cyberespionage group it has identified as APT37 is responsible for a number of “zero-day vulnerability” attacks not just in South Korea but also in Japan, Vietnam and in the Middle East. Zero-day attacks are when hackers find and exploit flaws in software before the developers have had an opportunity to create a patch to fix it.
“It’s like your security system is a big wall but someone knows that there’s a hole somewhere in that wall and can crawl through it,” Hultquist said. “It’s fairly rare.”
It’s also a sign of sophistication as hackers are able to obtain access and defeat mature security programs, he said.
[ U.S. declares North Korea carried out massive WannaCry cyberattack ]
Experts say all the evidence suggests that Lazarus, the cyber-collective that launched the embarrassing attack on Sony and was behind the $81 million cyberheist of a Bangladeshi bank in 2016, has links to the North Korean regime. It is also accused of masterminding last year’s WannaCry attack, which crippled companies, banks and hospitals around the world last year.
North Korea is also accused of numerous attacks in South Korea. The most recent involved the hacking of South Korean cryptocurrency exchange. The bitcoin exchange Youbit lost 17 percent of its total assets in the December attack, and said it would close down as a result.
But this APT37 appears to have been operating under the radar, exploiting holes in South Korean cyber security since 2012 to covertly gather intelligence on issues of concern for the North Korean regime: the government, military, media and human rights groups among them. These targets, together with the times of day that attacks happen, strongly point to North Korea, FireEye said.
Russia helped North Korea advance its missile program. Here are the Russian brochures selling their missile technology.
Last year, however, APT37 appears to have targeted a Japanese entity involved in imposing sanctions on North Korea, a Vietnamese company and one in the Middle East.
FireEye did not name any of the targets for legal reasons, but its description of the attack on the company in the Middle East perfectly describes Orascom
As well as expanding its geographical reach, APT37 also appears to be targeting a wider range of industries, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities, the report said.
[ The nation’s top spies said Russia is continuing to target the U.S. political system ]
While the damage is currently much lower than that caused by the huge cyberattacks blamed on North Korea, it suggests the regime is looking for new ways to launched stealthy attacks when it wants to.
The Worldwide Threat Assessment
Intelligence agencies expect North Korea to use cyber operations to gather intelligence or launch attacks on South Korea and the United States. “Pyongyang probably has a number of techniques and tools it can use to achieve a range of offensive effects with little or no warning, including distributed denial of service attacks, data deletion, and deployment of ransomware,” the assessment said.
Hultquist said that APT37 was just the kind of tool North Korea could use for a surprise attack, partly because it has been operating at a relatively low level.
“Lazarus and the other actors that are well known all started as espionage. That’s the classic story again and again,” he said, adding that the Kim regime didn’t seem to care about consequences.
“North Korea has flaunted global norms and taboos. They are not necessarily concerned about retribution. They have adopted this criminal M.O. which flies in the face of just about any kind of international norm.”
Read more:
NSA officials worried about the day its potent hacking tool would get loose. Then it did.
Clues point to possible North Korean involvement in massive ransomware attack
The leaders of both Koreas feel like they won gold medals this week
Today’s coverage from Post correspondents around the world
Like Washington Post World on Facebook and stay updated on foreign news