NK hacking group targets Korea-US combined exercise

In a coordinated effort, the South Korean police and the US military investigative agency have uncovered a malicious cyber attack by the North Korean hacking group "Kimsuky," aimed at the Korea-US combined military exercise battle simulation center, according to the police on Sunday.

According to the Gyeonggi Nambu Provincial Police Agency, the North Korean hacking group has carried out continuous malicious email attacks targeting a domestic battle simulation company for military engaged in virtual war games since April 2022. The investigation revealed that the group successfully installed a malicious code on the company's computer system in January 2023, by hijacking the email account of an administrative employee of the company.

Through remote access, the hackers were able to monitor the victim company's work progress and email activity in real time and steal the personal information of all employees.

The group then used the hijacked data to send malicious emails disguised as certificates of tax withheld to the employees dispatched to the Korea-US combined military exercise battle simulation center, starting in February this year.

While the security system of the US national defense digital network blocked the malicious code, some of the employees' personal computers were infected by forwarding the email to external accounts.

However, military-related information was not stolen, and the US military investigative agency recognized the hacking attack and confirmed the damage through information sharing with the police.

The police agency and the US military investigative agency found that the IP address used in the hacking attack matched the IP address band identified in the Korea Hydro & Nuclear Power Hacking attack in 2014. The similarity in methods and North Korean vocabulary used in previous attacks suggested that the “Kimsuky” group was responsible.

Both agencies have completed protection measures, including checks for infected public and personal computers and security training for employees attending the Korea-US combined military exercises to prevent further damage.

Furthermore, the Gyeonggi Nambu Provincial Police Agency confirmed the existence of emails impersonating the directorate of personnel of the US army, sent to Korean employees in the United States Forces Korea in July 2023, just a month before the Korea-US Ulchi Freedom Shield combined military exercise scheduled for August 21-31. The police are collaborating with the US military investigative agency on this ongoing investigation.