Following coverage of cyber espionage a ctor dubbed APT45 by leading threat detection organisation Mandiant, this research by the company’s representatives Taylor Long, Jeff Johnson, Alice Revelli, Fred Plan, and Michael Barnhart gets further into the heart of the matter.
In the ever-changing landscape of global cybersecurity, one group has consistently flown under the radar while leaving a trail of disruption in its wake: APT45. This North Korean cyber operator has been active since 2009, evolving from an espionage outfit to a multifaceted digital threat. Unlike its counterparts, APT45 has ventured into new and dangerous territory, blending traditional state-sponsored espionage with financially motivated cybercrime—a combination that sets it apart in the shadowy world of North Korean cyber warfare.
A Decade in the Dark
APT45’s journey began quietly, with its early years marked by targeted espionage campaigns against government agencies and the defense sector. These operations, while effective, were relatively standard fare for a North Korean cyber unit. However, as the group gained experience and resources, its mission evolved. By 2017, APT45 had expanded its scope, delving into sectors that aligned with North Korea’s shifting priorities—most notably, the nuclear and energy industries.
The group’s activity took on a more aggressive tone in 2019 when it targeted critical infrastructure, including nuclear facilities like India’s Kudankulam Nuclear Power Plant. This marked a significant escalation in APT45’s operations, signaling a willingness to strike at the heart of global security.
Financial Motivation: A New Chapter
What truly sets APT45 apart from its peers is its foray into financially motivated cybercrime. While North Korean cyber units have long been associated with state-sponsored hacking, APT45 has taken this a step further by potentially engaging in ransomware operations. This represents a bold departure from the norm, reflecting the group’s adaptability and the regime’s growing reliance on cyber operations as a source of revenue.
From 2016 onward, APT45 has been linked to several high-profile attacks on financial institutions across Asia. In one notable instance, the group likely used RIFLE malware to target a South Korean financial organization. The attacks continued over the years, with APT45 employing spear-phishing tactics against a South Asian bank as recently as 2021.
These financially motivated operations are not merely about self-sustenance for the group; they also serve a broader purpose. It is plausible that the funds generated from these attacks are being funneled back into the North Korean state, supporting a regime that has increasingly turned to cybercrime as a means of circumventing international sanctions.
The Ransomware Question
While concrete evidence linking APT45 to ransomware remains elusive, there is growing suspicion that the group has dabbled in this lucrative form of cybercrime. Public reports have hinted at APT45’s involvement in ransomware campaigns, particularly those using the SHATTEREDGLASS malware.
The potential use of ransomware by APT45 would represent a significant escalation in the group’s activities, aligning with North Korea’s broader strategy of using cyber operations to generate revenue. It’s a strategy that reflects the regime’s growing desperation as it faces mounting economic challenges at home.
Targeting What Matters Most
APT45’s choice of targets reveals much about North Korea’s priorities. In addition to its financial exploits, the group has shown a keen interest in sectors that are critical to the regime’s survival. During the COVID-19 pandemic, APT45 focused on healthcare and pharmaceutical companies, likely seeking to gather intelligence that could aid in managing the outbreak within North Korea.
In 2020, as the country grappled with deteriorating agricultural production, APT45 targeted the crop science division of a multinational corporation. This attack, like many others, was likely driven by the regime’s need to address domestic deficiencies through the theft of intellectual property.
A Unique Arsenal
APT45’s technical capabilities are as varied as its targets. The group has developed a sophisticated library of malware, ranging from publicly available tools like 3PROXY to custom-built malware families designed to carry out specific missions. Over time, these tools have evolved, incorporating unique encoding techniques and other distinct features that have become APT45’s signature.
This technical prowess has allowed APT45 to remain effective across a wide range of operations, from traditional espionage to cutting-edge cybercrime. Despite the group’s diverse capabilities, its malware remains relatively distinct from other North Korean activity clusters, highlighting APT45’s unique role within the broader framework of North Korean cyber operations.
The Future of APT45
As North Korea’s geopolitical landscape continues to evolve, so too will APT45’s mission. The group has already demonstrated a remarkable ability to adapt to changing circumstances, shifting from espionage to cybercrime and targeting everything from critical infrastructure to financial institutions.
Looking ahead, APT45 is likely to remain a key player in North Korea’s cyber strategy. Its operations will continue to reflect the regime’s shifting priorities, whether that means targeting new sectors, developing more sophisticated malware, or further expanding into the realm of financially motivated cybercrime.
APT45’s journey is far from over. As long as North Korea continues to rely on cyber operations as a tool of statecraft, APT45 will remain at the forefront of the regime’s digital warfare efforts. For the rest of the world, this means staying vigilant against a group that has proven itself to be as adaptable as it is dangerous, a silent cyber warrior in service of one of the world’s most isolated and unpredictable regimes.
