Exclusive: 2022 record for crypto theft in North Korea, says UN report

[ad_1]

UNITED NATIONS, Feb 6 (Reuters) – North Korea stole more cryptocurrency assets in 2022 than any other year and targeted the networks of foreign aerospace and defense companies, according to a currently confidential United Nations report seen by Reuters on Monday.

“(North Korea) has used increasingly sophisticated cyber techniques both to access digital networks involved in cyber finance and to steal information of potential value, including for its weapons programs,” reports said. independent sanctions monitors to a committee of the UN Security Council.

Observers have previously accused North Korea of ​​using cyberattacks to help fund its nuclear and missile programs.

“A higher value of cryptocurrency assets was stolen by DPRK actors in 2022 than in any previous year,” the observers wrote in their report – submitted to the North Korea sanctions committee on Friday. of the 15-member council – citing information from UN member states and cybersecurity. companies.

Latest updates

See 2 more stories

North Korea has previously denied allegations of hacking or other cyberattacks.

Sanctions monitors say South Korea estimates North Korea-linked hackers stole virtual assets worth $630 million in 2022, while cybersecurity firm assesses cybercrime North Korean had generated cybercurrencies worth more than a billion dollars.

“The variation in the USD value of the cryptocurrency over the past few months has likely affected these estimates, but both show that 2022 was a record year for virtual asset theft in the DPRK (North Korea)” , says the UN report.

A US blockchain analytics firm came to the same conclusion last week.

The UN report noted, “Techniques used by cyber threat actors have become more sophisticated, making it more difficult to track stolen funds.”

The report is due out later this month or early next month, diplomats said.

EXTORTION

The monitors said most of the cyberattacks were carried out by groups controlled by North Korea’s main intelligence office – the Reconnaissance General Bureau. He said those groups included hacking teams tracked by the cybersecurity industry under the names Kimsuky, Lazarus Group and Andariel.

“These actors continued to illegally target victims to generate revenue and solicit information useful to the DPRK, including its weapons programs,” the UN report said.

Sanctions monitors said the groups deployed malware through various methods, including phishing. One such campaign targeted employees of organizations in different countries.

“Initial contact with the individuals was made via LinkedIn, and once a level of trust with the targets was established, malicious payloads were delivered via ongoing WhatsApp communications,” the report said. UN.

He also said that according to a cybersecurity firm, a North Korea-linked group known as HOlyGhOst had “extorted ransoms from small and medium-sized businesses in several countries by distributing ransomware as part of a widespread financially motivated campaign”.

In 2019, UN sanctions monitors reported that North Korea had generated around $2 billion over several years for its weapons of mass destruction programs using widespread and increasingly sophisticated cyberattacks.

BREAKING SANCTIONS

In their latest annual report, the observers also said Pyongyang continued to produce nuclear fissile material at its facilities and launched at least 73 ballistic missiles, including eight intercontinental ballistic missiles last year.

The United States has long warned that North Korea is ready to conduct a seventh nuclear test.

North Korea has long been banned from nuclear testing and ballistic missile launches by the Security Council. Since 2006, it has been subject to UN sanctions, which the Security Council has tightened over the years to target Pyongyang’s nuclear and ballistic missile programs.

But North Korea continued illicit refined oil imports and coal exports, avoiding sanctions, observers said. They also said they had opened an investigation into reports of North Korea’s ammunition exports.

The United States has accused Russian mercenary company Wagner Group of receiving weapons from North Korea to help bolster Russian forces in Ukraine. North Korea dismissed the accusation as baseless, and Wagner’s owner, Yevgeny Prigozhin, denied obtaining any weapons from North Korea.

Last May, China and Russia vetoed a US-led campaign to impose more UN sanctions on North Korea. This included a proposal to freeze the assets of the Lazarus hacking group.

The Lazarus Group has been accused of involvement in the “WannaCry” ransomware attacks, the hacking of international banks and customer accounts, and the 2014 cyberattacks on Sony Pictures Entertainment.

The United States has linked North Korean hackers to the theft of hundreds of millions of dollars in cryptocurrency linked to popular online game Axie Infinity, the United States said in April. Ronin, a blockchain network that allows users to transfer crypto in and out of the game, said digital money worth nearly $615 million was stolen in March 2022.

Reporting by Michelle Nichols; Editing by Don Durfee and Stephen Coates

Our standards: The Thomson Reuters Trust Principles.

[ad_2]