The South Korean Atomic Research Facility Hack

South Korea’s government funded Korea Atomic Energy Research Institute (KAERI) was announced by Ha Tae-keung of the parliamentary intelligence committee to have been hacked on May 14, 2021 by North Korean threat actors from the cybercriminal group Kimsuky.

KAERI, located in Daejeon, South Korea, develops nuclear technologies. The hack occurred in May, but it sits uneasily in the minds of those who learn of the situation due to the incident being reported publicly on Friday, June 18, 2021, over a month later. KAERI is quoted as stating the hack was a

“mistake in the response of the working-level staff.”

However, many feel KAERI and the South Korean government tried to hide the breach and did not announce it until word got out by other means.

How it Happened

The hack is strikingly similar to that of the Colonial Pipeline Company in the United States that also occurred just a week prior on May 7, 2021. In the Colonial Pipeline Hack, the VPN used was a result of information from a prior hack being sold on the Dark Web. Colonial never terminated that VPN account, resulting in a costly almost $5 million ransomware attack orchestrated by threat actors from Darkside wich Colonial Pipeline Company chose to pay. A threat actor is an individual or group of people working to maliciously obtain data and resources in illegal ways online. KAERI was also exposed through a vulnerability in a VPN account. The attack on KAERI used 13 IP Addresses, one of which was linked back to Kimsuky from a prior breach. KAERI blocked all 13 IP addresses and patched their security systems to prevent further attacks to lessen the chance of another VPN vulnerability.

VPN

VPN, or Virtual Private Network, works as a middle man between you and the internet. It creates an encrypted blind spot that is meant to keep you, your IP address, and your data safe. However, it is also a favorite route of entry by hackers as it masks your physical location. It can also be used to access content on websites that is only available in certain geographical locations. Kimsuky was identified because the IP addresses used were able to be seen since they were connected to KAERI’s network. VPN is heavily relied upon at the moment by most companies (especially during the age of work-from-home during the pandemic), but may be in need of a heavy overhaul to make it more secure amidst privacy concerns from multiple major companies and government agencies.

Kimsuky

Kimsuky is well-known in South Korea for having been operating and actively attempting to infiltrate think tanks (research institutes holding some of the country’s most preciously guarded information) since 2012. The group uses technology called AppleSeed to intrude South Korean Windows operating systems.

It is known that Kimsuky has ties to North Korean government officials such as the North Korean Reconnaissance General Bureau (similar to the Central Intelligence Agency in the US), and suspected that he targets nuclear development centers to find a solution to North Korea’s electric power shortage crisis.

According to The Hacker News, Kimsuky recently went after other agencies. These included the

“Ministry of Foreign Affairs, Ambassador of the Embassy of Sri Lanka to the State, International Atomic Energy Agency (IAEA) Nuclear Security Officer, and the Deputy Consul General at Korean Consulate General in Hong Kong.”

As of June 1, 2021, Kimsuky has still been found to be actively trying to hack into South Korean think tanks. Fore more information on North Korean hacking, this is an excellent article.

Sources and Resources:

https://thehackernews.com/2021/06/north-korea-exploited-vpn-flaw-to-hack.html

https://abcnews.go.com/International/north-korea-attempted-hack-south-koreas-nuclear-tank/story?id=78372452

https://analyticsindiamag.com/are-vpns-as-safe-as-we-thought/

https://www.newyorker.com/magazine/2021/04/26/the-incredible-rise-of-north-koreas-hacking-army

https://malpedia.caad.fkie.fraunhofer.de/actor/kimsuky

https://medium.com/@brittnunez/the-colonial-pipeline-hack-timeline-and-how-ransom-funds-were-retrieved-887c2de214a0

originally posted this article on Medium at https://medium.com/@brittnunez/the-south-korean-atomic-research-facility-hack-e189cc8f7692