Overview of AhnLab’s Response to Joint Cybersecurity Advisory Between South Korea and the United States on North Korean Ransomware

On February 10, intelligence agencies from South Korea and the United States announced a cybersecurity advisory in regard to ransomware attacks from North Korea. It is the first joint report between the South Korean National Intelligence Service and the United States’ National Security Agency (NSA), Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Department of Health and Human Services (HHS) to raise awareness of cyberattacks from North Korea and protect both countries from ransomware. 

• Title: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities
• Security Advisory:
  • South Korea’s National Cyber Security Center (NCSC)  Go to site
  • United States’ Cybersecurity and Infrastructure Security Agency (CISA)  Go to site

Agencies from South Korea and the United States determined that the ransomware cases of Maui and H0lyGh0st, which attacked institutions in charge of the United State’s medical and public health sectors as well as other crucial infrastructure, originated from North Korea. They then published relevant TTP (tactics, techniques, and procedures) data and indicators of compromise. 

Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP. For subscription details, click the banner below.