Input: Challenge your security vendors.


Input: Demand better technology and services to detect, respond, but most importantly PREVENT not just contemporary attacks, but future exotic attacks that have yet to be imagined.


Input: That is what truly disruptive and innovative technology is.


Input: Don't settle for anything less.


Input: We hope that by exposing the Operation Cleaver team to the world, current global critical infrastructure victims can be notified, and prevent future victimization from suffering the consequences of'' status quo'' security.


Input: Unlike United Flight 811, perhaps we can prevent the next disaster.


Input: DEFENDERS, NEVER GIVE UP! In the face of growing and evolving threats, traditional cyber protection technologies are now widely considered inadequate.


Input: The only way to regain the upper hand against a new generation of attackers, is to embrace something entirely new.


Input: Something that'' thinks'' like an attacker.


Input: Something that doesn't rely on a trust model or care about hash lookups.


Input: Something with a brain.


Input: Cylance has eschewed the old foundations that existing cybersecurity products are built upon.


Input: Instead, we've based our approach on mathematics, machine learning, and data science.


Input: This algorithmic approach has been proven to detect–and stop–exponentially more modern threats.


Input: Leveraging algorithmic risk modeling, CylancePROTECT protects endpoints from everyday viruses, worms, trojans, and spyware, but unlike other security products, CylancePROTECT offers true future-proof protection against the most malicious threats in the world.


Input: Advanced Persistent Threats (APT), 0-days, and exotic exploitation techniques are easily detected and halted with little-to-no impact on the end-user.


Input: Existing reactive solutions rely on a constant stream of signature updates for threat detection, which is not only costly and inconvenient, but also requires'' sacrificial lambs''.


Input: Only after a previously unseen threat has inflicted damage can the rest of the industry begin to detect it.


Input: CylancePROTECT doesn't require constant updates or even a network connection to protect against so-called'' previously undetectable'' threats.


Input: By identifying and defusing attacks in near real time, before the attack can execute, we can finally do away with the need for a'' patient zero''.


Input: As Richard Stiennon, Chief Research Analyst at IT-Harvest, put it,'' Many vendors are trying to solve the endpoint problem, yet Cylance is the only one using the power of math to stop malware and with more effectiveness and efficiency than current solutions''.


Input: Interested in seeing what CylancePROTECT can do for your organization? Contact us! Cylance is one of the fastest growing cybersecurity technology firms in the US.


Input: Cylance's flagship product CylancePROTECT has been adopted by Fortune 500 companies and government agencies across the globe.


Input: Cylance was founded by 27-year security industry luminary, Stuart McClure, former Global CTO of McAfee, original founder of Foundstone, and lead author of the international best-selling book Hacking Exposed.


Input: In building Cylance, Stuart brought together the best scientific and executive minds from the likes of Cisco, Sourcefire, Google and McAfee.


Input: The Cylance board of advisors includes former high-ranking officials from the DHS, the FBI, CIA, and executive titans of business.


Input: CylancePROTECT is the only next generation endpoint security product that applies math to mute existing and future malware, viruses, worms, trojans, bots, APTs, 0-days, exploits, adware, spyware and hacking tools–without needing any updates or even a connection to the Internet.


Input: The technology is founded on the principle that to fix the industry, you must start from scratch with a way as yet unseen.


Input: CylancePROTECT does not rely on signatures of any sort (blacklist or whitelist), behavioral analysis using IOCs, sandboxing analysis, heuristics, micro-virtualization, or dynamic detonation–to detect and prevent malicious files from executing on a target endpoint.


Input: While every other endpoint security product must collect a sample, analyze, and write a signature to detect it, CylancePROTECT can detect malware before it executes by statically analyzing features found in the binary itself.


Input: Features and Benefits of CylancePROTECT: • Near real time detection of malicious files, even if they've never been seen in the wild.


Input: • Can be used to augment existing endpoint security or be deployed as a complete replacement.


Input: • Does not require any signature updates or connection to the cloud.


Input: • An easy-to-use web management console with intuitive workflows.


Input: • Low-impact endpoint agent.


Input: For a demo of CylancePROTECT, contact a Cylance expert today! Cylance's Professional Services team is available to assist companies affected by this campaign.


Input: Cylance is providing consulting to companies that may have been targeted by these advanced threat actors.


Input: Cylance will perform initial triage in order to determine the extent to which your company has been affected by this campaign and work towards establishing a containment strategy.


Input: Cylance has two tailored offerings for clients affected by this campaign.


Input: The first one includes ICS in our incident response since many companies affected are in the Critical Infrastructure and Key Resources (CIKR) vertical.


Input: The second offering's focus is to deploy our proprietary tools and methodologies to detect and mitigate the threats posed by Operation Cleaver.


Input: For more information on how the Cylance Professional Services team can assess and respond to attacks like the ones obseved in Operation Cleaver, contact sales @cylance.com today.


Input: Brian is a Sr. Security Researcher for Cylance who joined shortly after the company was established.


Input: He is best known for his avid botnet research (often going by'' botnethunter'') and for his novel malware analysis in the A Study in Bots blog series hosted by Cylance.


Input: Brian has been a dedicated open-source developer as well as an advocate for public and private anti-botnet operations.


Input: Brian actively develops techniques to combat cyber oppositions in positions where resources and leverage are in too limited of supply for conventional means.


Input: These techniques, cultivated by Stuart McClure, are the Art of Deterrence.


Input: In a previous investigation, Art of Deterrence techniques were successfully used to divert Indonesian hackers motivated by monetary gain away from their highest yielding target group.


Input: Brian's botnet research covers a wide range of topics, from using graph analysis to estimate the amount of ransom that has been paid to a ransomware operator, to utilizing IPv4 scanning techniques to identify and take down point of sale malware panels.


Input: Stuart is founder, CEO/President and Chairman of Cylance.


Input: Widely recognized for his extensive and in-depth knowledge of security products, Stuart McClure is considered one of the industry's leading authorities in information security today.


Input: A well-published and acclaimed security visionary with currently eleven books in print, McClure is the originating founder of the Hacking Exposed series of books, the most successful security book ever written.


Input: From his work, he founded Foundstone in October of 1999 which sold to McAfee in 2004.


Input: McClure brings over two decades of technology and executive leadership with profound technical, operational, and financial experience.


Input: Besides Foundstone, Stuart held leadership positions at InfoWorld, Ernst & Young, Kaiser Permanente and a number of government agencies.


Input: At McAfee, McClure held numerous positions including SVP/General Manager for the Security Management BU as well as EVP/Global Chief Technology Officer responsible for almost $3B worth of revenues.


Input: Today, McClure is CEO of Cylance, a disruptive and innovative startup applying math to the problem of security.


Input: Cylance products such as CylancePROTECT prevent the most advanced attacks in the world without signatures or sandboxing in realtime on the endpoint.


Input: Cylance Services offer highly specialized security services such as incident response, forensics, compromise assessments and advanced penetration assessments for global critical infrastructure.


Input: Cylance employees work passionately and tirelessly every day to achieve one goal: Protect the world from cyber attacks.


Input: And with their efforts in tracking Operation Cleaver, they have achieved that goal.


Input: Our endless thanks to all the Cylancers who contributed to this report.


Input: The Operation Cleaver logo, created by Cylance specifically for this report, was inspired by the infamous logo used by the Army of the Guardians of the Islamic Revolution, also known in the west as the Iranian Revolutionary Guard Corps (IRGC).


Input: Due to the close connection between the members tracked in this report and the IRGC, it was only fitting to replicate the look and feel of the IRGC's iconography as the anchor for this document's branding.


Input: The striking visual elements that make up the logo of the IRGC have very specific meanings: • The clenched fist holding a rifle, most likely an AK-47, represents armed resistance.


Input: • The globe symbolizes the IRGC's worldwide ambitions.


Input: • The book, from which the clenched first emanates, represents the Qur'an, connecting the religious ideals on which the group was founded to the armed struggle.


Input: • The plants, possibly wheat, represent prosperity.


Input: • The name of the group in Persian, the year in which it was founded and a passage from the Qur'an (8:60)'And make ready against them all you can of power', are represented in text.


Input: Several of the visual elements present in the IRGC logo have been carried over to the Operation Cleaver logo including: • A clenched fist, this time holding a cleaver, represents the group's likely connection with the IRGC as well as armed resistence in general.


Input: • The globe in the background represents Operation Cleaver's worldwide reach.


Input: • An ethernet cable connected to the clenched first represents the nature of these attacks (cyber as opposed to traditional warfare).


Input: • The hex string translates to'' Think Evil, Do Good'', a mantra our research team lives by.


Input: This Appendix details the IOCs discovered in the investigation of Operation Cleaver.


Input: CylancePROTECT prevents the malware used in Operation Cleaver from ever executing.


Input: These mutexes are used with the process ID of the malware as a suffix: Listed below are both the MD5 and SHA-256 hashes for samples related to Operation Cleaver.


Input: Thank you for subscribing to Episode 16 of the HP Security Briefing.


Input: In this edition we discuss the cyber landscape within the Democratic People's Republic of Korea.


Input: The Democratic People's Republic of Korea (DPRK), known in the West as North Korea, is a unique country with a military-focused society and an unconventional technology infrastructure.


Input: While North Korea was formerly on the U.S. list of state sponsors of terrorism, it was removed in 2008.


Input: However, due to North Korea's hostility toward other nations, its pursuit of nuclear weapons, and human rights violations against its own citizens, the United Nations and many Western entities have placed sanctions and embargoes against North Korea.


Input: For example, U.S. export laws forbid the sale of dual-use technologies, or those that can be used or repurposed for both civilian and military use, to North Korea.


Input: < /n > 5 < /fn > Additionally, the U.S. has a military alliance with the Republic of Korea (ROK), known in the West as South Korea, North Korea's primary target of conflict.


Input: Due to North Korea's global interactions, its cyber warfare capabilities are of particular interest to the U.S.


Input: According to a 2009 report by Major Steve Sin, an intelligence analyst at U.S.


Input: Forces Korea, North Korean hackers have successfully penetrated U.S. defense networks more frequently than any other country that has targeted U.S. defense assets.


Input: While Major Sin may have been overly optimistic about North Korea's abilities, it is clear that they should not be underestimated.


Input: Frank Cilluffo, co-director of the Cyber Center for National and Economic Security at George Washington University, testified before Congress that North Korea's cyber capability'' poses an important'wild card' threat, not only to the United States but also to the region and broader international stability…'' In an April 2014 testimony given to the House Armed Services Committee, General Curtis M. Scaparrotti noted that'' North Korea remains a significant threat to United States' interests, the security of South Korea, and the international community due to its willingness to use force, its continued development and proliferation of nuclear weapon and long- range ballistic missile programs, and its abuse of its citizens' human rights, as well as the legitimate interests of its neighbors and the international community.


Input: '' Scaparrotti stressed that'' While North Korea's massive conventional forces have been declining due to aging and lack of resources…North Korea is emphasizing the development of its asymmetric capabilities.


Input: North Korea's asymmetric arsenal includes…an active cyber warfare capability.


Input: '' While one would expect the regime's digital infrastructure to also suffer from aging or lack of resources, these factors do not take away from their technical abilities to wage cyber warfare.


Input: While the U.S. views North Korea's cyber warfare program as the regime's foray into modern asymmetrical warfare, South Korea views the regime's cyber capabilities as a terroristic threat, -a build-up for an impending multifaceted attack.


Input: It is important to note that, to date, no such attack has occurred.


Input: According to a report written by Captain Duk-Ki Kim, Republic of Korea Navy officer and Ph.D.'' …the North Korean regime will first conduct a simultaneous and multifarious cyber offensive on the Republic of Korea's society and basic infrastructure, government agencies, and major military command centers while at the same time suppressing the ROK government and its domestic allies and supporters with nuclear weapons.


Input: '' South Korea's view of North Korea as a terroristic threat may be an attempt to downgrade North Korea politically, since South Korea does not recognize the regime as a legitimate state.


Input: South Korean reports also claim that North Korea's premier hacking unit, Unit 121, trails Russia and the U.S. as the world's third largest cyber unit.


Input: While this claim may be exaggerated, in 2012, South Korean reports estimated North Korea's hacker forces at around 3000 personnel.


Input: In a July 2014 report from South Korea's Yonhap News Agency, that figure was upgraded to 5900 hacker elite.


Input: We must stress that although these claims have not been corroborated, South Korea has taken the regime's cyber threats very seriously and is reportedly training 5000 personnel to defend against North Korean cyber attacks.


Input: Obtaining details on North Korea's cyber warfare capabilities is not an easy task.


Input: This paper will examine the known cyber capabilities of North Korea's regime and how the country maintains secrecy in these matters.


Input: Through information obtained via open source intelligence (OSINT), we will present what is known about North Korea's cyber warfare and supporting intelligence and psychological operations capabilities.


Input: The following conditions proved to be research roadblocks when gathering intelligence regarding North Korea's cyber warfare capabilities:  Much of the intelligence available on North Korea is dated and may not accurately reflect the regime's current capabilities.


Input:  Much of the intelligence available on North Korea comes from U.S. or South Korean military or agency reports.


Input: These reports omit details that are likely classified, such as specific IP addresses and individual actor information.


Input:  While South Korea is an ally of the United States, its reports on North Korean cyber activity potentially contain incomplete or biased information.


Input: Cultural factors that stem from a history of tension and conflict between the two nations may skew perception and make objectivity difficult.


Input:  North Korea's Internet infrastructure and the regime's strict control over its use ensures that there are no rogue actors and that all officially sanctioned actors exercise careful OPSEC and PERSEC practices in order to prevent inadvertent information leaks.


Input: In other words, there was no significant identifying information in the form of an OSINT trail left behind by the actors.


Input: This hinders collection of original, actionable threat intelligence and individual actor attribution.


Input:  North Korea is well-isolated from the outside world, and its strong intelligence and psychological operations presence effectively creates confusion via counterintelligence and disinformation about the regime's capabilities.


Input: For this reason, any'' official'' reports emanating from North Korea must be taken with a grain of salt.


Input: This also hinders attempts to obtain original, actionable threat intelligence.


Input: In order for Westerners to understand the North Korean mindset, it is necessary to examine the key components of North Korean political and ideological thought.


Input: It is also necessary to provide a brief explanation of how North Korea and South Korea view one another, in order to understand the basis for conflict between the two.


Input: North Korea has two primary ideologies that provide context for the regime's motivations and activities: juche (ju-cheh) and songun (sun-goon).


Input: Juche is the official political ideology of North Korea.


Input: It was instituted in 1972 and is based on the ideologies of Kim Il-Sung, the founder of the DPRK.


Input: Juche emphasizes self-reliance, mastering revolution and reconstruction in one's own country, being independent of others, displaying one's strengths, defending oneself, and taking responsibility for solving one's own problems.


Input: North Korea's air-gapped intranet, described below, exemplifies this philosophy in the country's cyber infrastructure.


Input: The juche philosophy explains North Korea's disdain for outside cultural and political influence.


Input: Juche challenges North Koreans to contribute to the regime's chaju (ja-ju), a concept of national sovereignty and independence.


Input: The regime's greatest fear is internal dissent and resulting destabilization.


Input: In a June 2014 Reddit AMA session, Dr. Andrei Lankov, an expert on North Korean culture and society, noted'' there are also serious signs of public alienation and discontent.


Input: And I can not rule out a public outbreak of such discontent in the near future.


Input: Of course, if it happens, it will have a serious impact on the government.


Input: '' Despite North Korea's strong conviction in juche, the regime collaborates with and receives support from other nations.


Input: However, due to this deep-seated ideology, it is doubtful that North Korea fully trusts these apparent allies.


Input: Later in this document, we will show that North Korea relies heavily on China for Internet access.


Input: North Korea also collaborates with China and Russia to train its cyber warriors and has longstanding political and military relationships with several nations.


Input: Songun is North Korea's'' military first'' doctrine.


Input: Songun emphasizes the priority of the military in resource allocation and political and economic affairs.


Input: This doctrine stems from the belief that the military is vital for preservation of chaju.


Input: Understanding songun mindset gives context for this potential threat actor's motivations.


Input: According to a 2013 Congressional report, the strategy established under former leader Kim Jong-Il focused on'' internal security, coercive diplomacy to compel acceptance of its diplomatic, economic and security interests, development of strategic military capabilities to deter external attack, and challenging South Korea and the U.S.-South Korean alliance.


Input: '' North Korea's songun permeates the lives of all North Korean citizens.


Input: Article 58 of the North Korean Constitution states that the nation should base itself on a nationwide defense system that includes all people.


Input: North Korea, with a population of 25 million, has an active duty force of 1.19 million personnel, the fourth largest in the world.


Input: The country's reserve and paramilitary units comprise 7.7 million additional personnel.


Input: In other words, over a third of the country's population serves in a military or paramilitary capacity.


Input: Some North Korean youth aged 7-13 are inducted into the Korean Children's Union.


Input: The Korean Children's Union is responsible for indoctrinating youths who pledge to build up their strength to later defend the regime.


Input: Children aged 14-16 can begin military training as members of the Young Red Guards, a paramilitary unit.


Input: Beginning at age 17, North Koreans are eligible to join the Reserve Military Training Unit.


Input: The Reserve Military Training Unit forms the core of North Korea's reserves and is typically assigned to the front or regional defense in wartime.


Input: The youngest age at which a citizen can be conscripted for active duty is unclear; reported ages range from 18-20.


Input: Youths can volunteer for active duty service at age 16 or 17.


Input: The Worker-Peasant Militia, or Red Guards, includes males ages 17-60 and unmarried females ages 17-30 who are not part of active duty units or the Reserve Military Training Unit.


Input: The regime has an impressive number of conventional weapons, considering the nation's small land area and population size.


Input: According to statistics released by CNN in 2014, North Korea's ground arsenal includes 4100 tanks, 2100 armored vehicles, and 8500 pieces of field artillery.


Input: The regime's sea weaponry includes 70 submarines, 420 patrol combatants, and 260 amphibious landing craft.


Input: Their airpower includes 730 combat aircraft, 300 helicopters, and 290 transport aircraft.


Input: While the limits of the regime's ballistic missile program are unknown, North Korea is thought to have fewer than 100 short-range missiles and fewer than 100 medium to long-range missiles.


Input: However, in recent years, North Korea has suffered oil, fuel, electricity, and food shortages.


Input: Without aid from another entity, the regime does not have sufficient resources to maintain and sustain the majority of its weapons and associated personnel for rapid deployment or prolonged combat.


Input: Tension between North and South Korea has continued well past the armistice meant to end the Korean War.


Input: Neither nation recognizes the other as a legitimate state.


Input: South Korea's constitution legally defines South Korean territory as the entire Korean peninsula and its adjacent islands, with'' North Korea'' being a part of South Korea.


Input: North Korea also claims to be the sole government of the Korean Peninsula.


Input: Each country's claim of sovereignty and refusal to acknowledge the other as a legitimate state creates the condition for perpetual conflict.


Input: North Korea's negative sentiment towards the U.S. stems from two major factors: the U.S.–South Korea military alliance and North Korea's perception that the U.S. is imperialistic and prone to exploitative capitalism.


Input: In recent years, two primary factors have heavily influenced the current state of North Korea's relations with South Korea and her allies: the rise of the regime's leader Kim Jong Un and the inauguration of South Korean president Park Guen Hye.


Input: Kim Jong Un officially rose to power in April 2012, following the death of his father Kim Jong Il in December 2011.


Input: While his age remained a mystery for quite some time, it was later revealed that he was born in January 1983, making him age 31 at present.


Input: This makes Kim Jong Un the world's youngest leader of an established nation.


Input: The young leader's rise to power brought about several changes in North Korea.


Input: First, Kim Jong Un's personal life is more public and more extravagant than that of his father.


Input: Unlike his father, the young Kim is often accompanied by his wife when making public appearances.


Input: Second, the young Kim, who is more high-tech than his predecessor, is reported to have an affinity for luxury items and is an avid gamer and basketball fan.


Input: Third, Kim Jong Un is more totalitarian than his father.


Input: Following his rise to power, the regime reportedly expanded its labor camps, and more military resources were allocated to target those attempting to defect.


Input: Kim also executed his own uncle, a high-ranking official who did not share his ideals.


Input: These moves indicate the regime's priority to deter internal destabilization and dissent, which is perceived to be a greater threat than outside adversity.


Input: According to Phil Robertson, deputy Asia director at Human Rights Watch,'' The government now recognizes that the accounts of escaping North Koreans reveal Pyongyang's crimes–so it is doing what it can to stop people from fleeing.


Input: '' Under Kim Jong Un's rule, the regime has stepped up its nuclear materials production, and the propaganda distributed by state media has become more menacing.


Input: The regime's response to perceived threats has also become more volatile.


Input: Christian Whiton, a former deputy envoy to North Korea, noted that following Kim Jong Un's rise to power,'' the regime still acts in a very belligerent manner, but it seems less predictable, and more random.


Input: '' Ellen Kim, assistant director of the Korea Chair at the Center for Strategic and International Studies, assessed the situation thusly:'' Since [Kim Jong Un] took power he has purged almost all of his elder guardians ...


Input: and filled his surroundings with new faces.


Input: We are in a situation where we are learning about him a little bit every day through his unpredictable behavior and actions, which is why the current situation with North Korea is a lot more dangerous than before.


Input: '' The regime's recent reaction to an upcoming film supports these statements.


Input: The plot for the comedy film'' The Interview'' follows two talk show hosts who are asked to assassinate Kim Jong Un.


Input: The regime even sent a complaint about the movie to the UN.


Input: In response to the film, a North Korean official stated,'' The enemies have gone beyond the tolerance limit in their despicable moves to dare hurt the dignity of the supreme leadership.


Input: '' The official referred to the movie as'' the most undisguised terrorism and a war action to deprive the service personnel and people of the DPRK of their mental mainstay and bring down its social system.


Input: '' The official also issued a threat:'' If the U.S. administration connives at and patronizes the screening of the film, it will invite a strong and merciless countermeasure.


Input: '' This reaction demonstrates North Korea's priority of preserving the regime's self-perceived dignity in the global arena and its intolerance of any disrespect directed at the Kim family.


Input: While tensions between North and South Korea have persisted since the Korean War, these tensions escalated following the 2013 inauguration of South Korea's current president, Park Geun Hye.


Input: Her platform, in her words, is as follows:'' North Korea must keep its agreements made with South Korea and the international community to establish a minimum level of trust, and second there must be assured consequences for actions that breach the peace.


Input: To ensure stability, trustpolitik should be applied consistently from issue to issue based on verifiable actions, and steps should not be taken for mere political expediency.


Input: '' Shortly after Park's inauguration, North Korea denounced UN Security Council Resolution 2094, which is'' a resolution strengthening and expanding the scope of United Nations sanctions against the Democratic People's Republic of Korea by targeting the illicit activities of diplomatic personnel, transfers of bulk cash, and the country's banking relationships, in response to that country's third nuclear test on 12 February [2013].


Input: '' North Korea also responded strongly to joint U.S.-South Korea military exercises in March 2013, as is noted later in this paper.


Input: North Korea's cyber infrastructure is divided into two major parts: an outward-facing Internet connection and a regime-controlled intranet.


Input: North Korea's outward-facing Internet connection is only available to select individuals and is closely monitored for any activity that is deemed anti- regime.


Input: Individuals using the outward-facing Internet connection must be authorized.


Input: In 2013, Jean H. Lee, the Associated Press bureau chief in Pyongyang, stated that foreigners visiting North Korea are allowed Internet access with no firewalls.


Input: Common citizens are limited to using the Kwangmyong (gwang me-young), a nationwide intranet with no access to the world outside North Korea.


Input: According to Lee, Kwangmyong allows citizens'' access to the state media, information sources that are vetted by the government, and picked and pulled from the Internet and posted to their intranet site.


Input: '' As of May 2013, North Korea had only one'' Internet café.


Input: '' A 2003 report from the Office of the National Counterintelligence Executive stated that North Korea's'' Internet café'' was'' the only place in North Korea for the public to access the Internet'' and that foreigners were allowed to access the Internet from this café.


Input: Whether citizens are allowed to access the Internet from this location is unknown.


Input: Star Joint Venture Co. is responsible for providing North Korea's Internet access.


Input: Star Joint Venture Co. was established by the Post and Telecommunications Corporation in cooperation with Loxley Pacific in Thailand.


Input: In December 2009, Star Joint Venture became responsible for North Korea's Internet address allocation.


Input: Previously, Internet access was provided by a German satellite link via Korea Computer Center Europe or via direct connections with China Netcom, which was later merged into China Unicom.


Input: By October 2010, North Korea had made its first known direct connection to the Internet, hosting an outward-facing Korean Central News Agency website accessible from the global Internet.


Input: However, many of North Korea's globally accessible websites are hosted in other countries.


Input: In 2001, South Korean reports indicated that North Korea had joined the International Telecommunications Satellite Organization (INTELSAT).


Input: As of April 2012, North Korea reportedly used the Intelsat connection, which appeared in border gateway protocol (BGP) announcements.


Input: Some reports referred to the Intelsat connection as North Korea's backup Internet connection, in case the China Unicom connection fails.


Input: A March 2013 post on the blog rdns.im showed that North Korea no longer used the Intelsat connection.


Input: In the blog post, the author noted his method for proving that The Pirate Bay was not hosted in North Korea.


Input: While his analysis of The Pirate Bay's hosting is irrelevant to our research, he did detail that 175.45.177.0/24 always routes through AS4837, and AS131279.


Input: AS131279 is Star-KP, North Korea's Star Joint Venture Company, and AS4837 is China Unicom.


Input: The author concluded that'' all [traffic] is ONLY routed through China Unicom and NOT through Intelsat.


Input: '' In February 2014, North Korean and South Korean officials agreed to extend Internet access to Kaesong Industrial Zone, a jointly operated industrial complex just north of the border.


Input: However, this would likely require a major electrical and network infrastructure expansion.


Input: North Korea's electrical grid can not support a large technological infrastructure.


Input: Electrical power is reported to be unreliable and sporadic, with many citizens only receiving a few hours of electricity per day.


Input: The photo above (Figure 3), from the International Space Station, shows North Korea's sparse power grid, in comparison with surrounding nations.


Input: We have highlighted North Korea in red.


Input: Koryolink, the country's only cellular phone network, is tightly controlled by the regime.


Input: Cell phone data plans are not available to most users.


Input: Most cellular phones can not access the Internet and can only make domestic calls.


Input: According to a 2013 report, North Korea has a 3G data network for cellular phones.


Input: Visiting reporter Jean H. Lee purportedly used this 3G network to post to both Twitter and Instagram.


Input: However, citizens are not generally allowed to use the 3G network.


Input: Email is also regulated by the regime.


Input: The first email provider in North Korea was Silibank.


Input: Silibank has servers in Pyongyong and Shenyang and is a joint venture with China.


Input: The North Korean Silibank homepage is silibank.net, and the Chinese homepage is silibank.com.


Input: In order to use the email service, users had to initially register, provide personal information, and pay a registration fee and monthly service fees.


Input: This registration information was current as of 2001.


Input: However, it is unknown whether the same process still applies.


Input: WHOIS records for silibank.net show that the site was registered anonymously via a Japanese registrar.


Input: This information can be found in Appendix A at the end of this paper.


Input: Korea Computer Center (KCC) is North Korea's leading government research center for information technology.


Input: KCC has eleven regional information centers and eight development and production centers.


Input: Other countries with KCC branch offices include China, Syria, Germany, and United Arab Emirates.


Input: KCC has a vested interest in Linux research and is responsible for the development of North Korea's national operating system, Red Star OS, which is discussed in more detail below.


Input: KCC's other projects have included a proprietary search engine, a document writer, a game called Jang-Gi, the Kwangmyong intranet, a food study program, a Korean input method editor, a pen-based English-Korean and Korean-English translator, Korean voice recognition software, a video conferencing system, a distance education system, SilverStar Paduk software, HMS Player, and the Samjiyon tablet.


Input: In addition to research and development, KCC also monitors websites of foreign government and business entities and conducts technical reconnaissance to blueprint the technical specifications and vulnerabilities in foreign systems and technologies.


Input: KCC has also been involved in clandestine information and cyber operations, serving as a command center.


Input: North Korea's proprietary operating system is Red Star OS.


Input: The development of this Linux-based operating system started in 2002.


Input: Red Star OS is only offered in the Korean language and features proprietary software including Naenara (a Firefox-based browser), as well as a text editor, email client, audio and video players, and games.


Input: Red Star OS's keyboard layouts include Korean, English, Russian, Chinese, and Japanese.


Input: Regime ideals extend to Red Star OS.


Input: The readme file, which goes with the installation disc, reportedly includes a quote from Kim Jong-Il regarding the importance of North Korea having its own Linux-based operating system that is compatible with Korean traditions.


Input: While prior versions of Red Star were KDE-based, version 3.0 mimics Apple's OS X.


Input: This could indicate the regime leader Kim Jong Un's preference for the OS X environment, as Kim reportedly uses an iMac.


Input: Citizens do not need permission to obtain Red Star OS.


Input: However, the purchase of computers is heavily regulated.


Input: The OS's design suggests it was developed with means for the regime to monitor user activity.


Input: North Korea is known to use two IP ranges.


Input: 175.45.176.0/22 is North Korea's own IP block.


Input: Additionally, North Korea's Telecommunications Ministry is the registered user of China Unicom IP range 210.52.109.0/24.


Input: The country's only autonomous system (AS) number is AS131279, and its only peer is AS4837, the AS for China Unicom.


Input: North Korea's country code top-level domain (ccTLD) is .kp


Input: In 2007, the .kp


Input: TLD was initially delegated to and administered by the German-based KCC Europe.


Input: After KCC Europe failed to maintain the TLD, it was re-delegated to Star Joint Venture Company.


Input: The .kp


Input: TLD uses the following nameservers and IP addresses: Various U.S., U.N, and other sanctions prohibit export of dual-use technologies to North Korea.


Input: In light of this, North Korea has managed to develop both hardware and software and hosts an annual National Exhibition of Invention and New Technologies to promote its products.


Input: However, the regime has historically failed in its attempts at large-scale production of electronic components.


Input: The country's sparse electrical grid is one of the major obstacles hindering large- scale manufacturing.


Input: Additionally, the famine in the early 1990's negatively impacted existing manufacturing facilities, and the regime simply does not have the capital to modernize those factories.


Input: A member of the World International Property Organization (WIPO), North Korea joined the WIPO Patent Cooperation Treaty that protects patents and trademarks worldwide, and leverages intellectual property laws to ensure Westerners do not take credit for North Korean inventions.


Input: The regime, in its efforts to isolate its citizens from Western influence, leverages intellectual property laws to ensure Westerners do not take credit for North Korean inventions.


Input: This is ironic since foreign-made electronic components are sometimes smuggled into North Korea for military use and for personal use by the regime's upper echelon.


Input: A comparison of a scan of North Korea's IP ranges in November 2010, just one month after North Korea made its first direct connection to the Internet, and a series of several scans we conducted in May 2014, shows that North Korea has made significant headway in establishing its Internet presence.


Input: In the November 2010 scan, 175.45.176.0-175.45.176.16 showed a variety of devices including D-link, Cisco, Linksys, HP, and Nokia devices, and a Juniper networks firewall.


Input: Operating systems detected included FreeBSD 6.x, Linux 2.6.x, and Red Hat Enterprise Linux.


Input: 175.45.176.14 returned'' Naenara'' as an html-title.


Input: Most hosts in the 175.45.176.xx and 175.45.177.xx ranges were down.


Input: As of 2014, IP addresses 175.45.176.0-175.45.177.255 appear to be used for websites, nameservers, databases, email, and voice over IP (VoIP).


Input: In November 2010, the 175.45.178.xx range showed all hosts down, and the 175.45.179.xx range showed most hosts were down.


Input: In 2014, several webservers and nameservers were found in the 175.45.178.xx range, and several nameservers and mail servers were found in the 175.45.179.xx range.


Input: This comparison demonstrates that there has been some growth in DPRK Internet infrastructure over the past four years.


Input: However, it seemingly lags behind even most third world nations.


Input: The 2014 scans detected dated technology that is potentially susceptible to multiple vulnerabilities and consistently showed the same open ports and active devices on scanned hosts.


Input: It is not clear whether the regime failed to notice and react to the scanning or whether the regime allows these open ports and devices to be detected or spoofed to serve as a distraction or possible honeypot.


Input: Domains, nameservers, and mail servers present during the May 2014 scan are listed in Appendix B at the end of this report.


Input: According to Alexa rankings, the three most visited websites in North Korea are kcna.kp, the official website of the Korean Central News Agency (KCNA); rodong.rep.kp, another North Korean news site; and naenara.com.kp, North Korea's official web portal.


Input: Naenara translates to'' my country''.


Input: The kcna.kp site was registered using a Loxley.co.th email address and is administrated by Star Joint Venture Company.


Input: The WHOIS Record can be found in Appendix A. Rodong.rep.kp was registered using the same loxley.co.th email address and is also administered by Star Joint Venture Company.


Input: The WHOIS Record for this site can be found in Appendix A.


Input: The WHOIS information for Naenara.com.kp was not available.


Input: In March 2013, there were reports that the Chrome browser was blocking Naenara.com.kp due to malware.


Input: It is difficult to say whether this incident is a case of North Korea serving malware or whether a third party took advantage of an improperly secured website.


Input: Several major North Korean websites are hosted outside of North Korea.


Input: The popular Uriminzokkiri.com website, whose name translates to'' our nation,'' is hosted in China.


Input: The administrative contact for the website is Kim Sejun, and the email address given as contact information is hyk1979 @hotmail.com.


Input: The WHOIS Record for this site can be found in Appendix A.


Input: The website for Kim Il Sung Open University, otherwise known as'' Our Nation School'' is also hosted in China.


Input: The WHOIS record for this site can be found in Appendix A.


Input: At the top of North Korea's military structure is the National Defense Commission (NDC).


Input: The NDC is also the highest branch of government and the regime's supreme policymaking body.


Input: Along with the Central Committee of the Workers' Party of Korea and the Cabinet, NDC is at the top of North Korea's political hierarchy.


Input: Article 106 of North Korea's Constitution gives the NDC the following powers:  The power to establish policies of the state in accordance with the military-first revolutionary line.


Input:  The power to guide the armed forces and oversee defense building.


Input:  The power to supervise and ensure the NDC and its chairman's orders are executed and to establish necessary measures.


Input:  The power to override any state decisions or directives that are in opposition to the NDC or its chairman's decisions and directives.


Input:  The power to create or remove central organs of the national defense sector.


Input:  The power to create and bestow military titles above general-grade officer rank.


Input: The NDC oversees several defense and intelligence bodies including the Ministry of State Security, the Ministry of People's Security, the Ministry of People's Armed Forces, and the Korean People's Army.


Input: The Ministry of State Security (MSS), also known as the State Security Department, is North Korea's primary counterintelligence service.


Input: It is considered an autonomous agent of the regime and reports directly to leader Kim Jong Un.


Input: The MSS's duties include oversight of North Korean prison camps, investigation of domestic espionage, repatriation of defectors, and overseas counterespionage operations.


Input: The Ministry of People's Security is also known as the Ministry of Public Security (MPS).


Input: Focused on domestic order, it oversees North Korea's national police force, conducts criminal investigations and preliminary examinations, and oversees correctional facilities, excluding prison camps.


Input: While the roles of the MSS and MPS focus more on intelligence than on cyber operations, the MSS also reportedly has a communications monitoring and computer hacking group.


Input: The Ministry of People's Armed Forces (MPAF) administrates the Korean People's Army (KPA) and oversees the General Staff Department (GSD), which is responsible for operational command and control of North Korea's armed forces.


Input: The General Staff Department also oversees the Reconnaissance General Bureau (RGB), North Korea's agency for clandestine operations.


Input: The RGB has a role in both traditional and cyber operations.


Input: In the past, the RGB has sent agents on overseas military assistance missions to train insurgent groups.


Input: The RGB reportedly has a special operations forces (SOF) element and oversees six bureaus that specialize in operations, reconnaissance, technology and cyber matters, overseas intelligence collection, inter-Korean talks, and service support.


Input: Two of these bureaus have been identified as the No.


Input: 91 Office and Unit 121.


Input: The No.


Input: 91 Office, an office responsible for hacking, operates out of the Mangkyungdae-district of Pyongyang.


Input: Unit 121 comprises both an intelligence component and an attack component.


Input: Unit 121's headquarters is in the Moonshin-dong area of Pyongyang, near the Taedong River.


Input: It also has components that conduct operations from within China.


Input: One of Unit 121's command posts is Chilbosan Hotel in Shenyang, the capital of Liaoning Province, which borders North Korea.


Input: Shenyang is a Chinese military district.


Input: According to Dr. Alexandre Mansourov, an expert on North Korea and a visiting scholar at the U.S.-Korea Institute at Johns Hopkins University,'' They [Unit 121] are believed to have conducted hacking operations from inside China that falsify classified data and disrupt U.S. and South Korean systems.


Input: '' Both Unit 121 and an entity known as Lab 110 are reported to maintain technical reconnaissance teams responsible for infiltrating computer networks, hacking to obtain intelligence, and planting viruses on enemy networks.


Input: Several entities are nested under the Workers' Party.


Input: The Central Party Committee oversees the Central Party Investigative Group, also known as Unit 35.


Input: Unit 35 is reportedly responsible for technical education and training of cyber warriors.


Input: The Unification Bureau's Operations Department is responsible for cyber-psychological warfare, organizational espionage, and oversight of Unit 204.


Input: Unit 204's responsibilities include planning and execution of cyber-psychological warfare operations and technological research.


Input: The Psychological Operations Department of the North Korea Defense Commission also engages in cyber-psychological warfare.


Input: The 225th Bureau, or Office 225, is responsible for training agents, infiltration operations in South Korea, and creation of underground political parties in order to incite disorder and revolution.


Input: It plays a more traditional intelligence and psychological operations role, rather than focusing on cyber operations.


Input: The United Front Department (UFD) conducts overt operations to create pro-North Korean groups in South Korea.


Input: Examples of this activity include the Korean Asia-Pacific Committee and the Ethnic Reconciliation Council.


Input: The UFD also manages inter-Korean dialogue and North Korea's policy toward South Korea.


Input: Its operations are also more traditional rather than cyber-focused.


Input: The Liaison Department of the Worker's Party oversees a faction of ethnic North Koreans residing in Japan who are critical to North Korea's cyber and intelligence programs.


Input: This group, which was established in 1955, is referred to by various names including the Chosen Soren, Chongryon, and the General Association of Korean Residents in Japan.


Input: The Chongryon ascribe to juche and seek to preserve North Korean culture while living in Japan.


Input: They operate North Korean style schools and refuse to assimilate with Japanese culture.


Input: According to Mitsuhiro Suganuma, former section head of the second intelligence department of the Japanese Public Security Intelligence Agency (PSIA),'' Chongryon is virtually under the direct control of the Liaison Department of the Workers' Party of Korea, which has been in charge of North Korea's covert operations and underground activities against South Korea.


Input: Chongryon in Japan has been a strong support organization aimed at bringing a revolution in South Korea, or a red unification by force.


Input: '' He also stated'' North Korea will continue to make Chongryon serve as Pyongyang's pawn in covert operations against South Korea.


Input: '' The Chongryon are vital to North Korea's military budget, raising funds via weapons trafficking, drug trafficking, and other black market activities.


Input: The group also forms'' front companies'' abroad that benefit the regime by generating hard currency.


Input: One example is Unikotech, which was formed to sell KCC products abroad.


Input: The Chongryon's underground group known as the Gakushu-gumi, or'' the study group'', gathers intelligence for North Korea and helps the regime procure advanced technologies.


Input: The Chongryon's role in North Korean intelligence and resource acquisition is discussed below in more detail.


Input: The regime also has several government bodies under the Cabinet that oversee its infrastructure, intelligence, and technological development.


Input: These include the Central Scientific and Technological Information Agency (CSTIA), the Ministry of Electronics Industry, and the Ministry of Posts and Telecommunications.


Input: The CSTIA collects, analyzes, and processes data regarding advanced science and technology then sends relevant information to appropriate areas of the national economy.


Input: The amount of information contained in CSTIA's technical database makes it North Korea's largest scientific facility.


Input: According to a CIA article, review of CSTIA's publications showed that China, Russia, and Japan are important sources of technical data.


Input: CSTIA's publications include newsletters and an 18-volume science and technology reference series.


Input: The Ministry of Posts and Telecommunications is the body of oversight for Star Joint Venture Co. North Korea's cyber warfare doctrine has not been clearly stated.


Input: However, based on cultural and technical observations, we may deduce that North Korea's cyber doctrine follows the tenets of juche nationalism and the songun doctrine.


Input: Although North Korea's limited online presence makes a thorough analysis of their cyber warfare capabilities a difficult task, it must be noted that what is known of those capabilities closely mirrors their kinetic warfare tactics.


Input: Cyber warfare is simply the modern chapter in North Korea's long history of asymmetrical warfare.


Input: North Korea has used various unconventional tactics in the past, such as guerilla warfare, strategic use of terrain, and psychological operations.


Input: The regime also aspires to create viable nuclear weapons.


Input: Asymmetrical warfare is defined as'' a conflict in which the resources of two belligerents differ in essence and in the struggle, interact and attempt to exploit each other's characteristic weaknesses.


Input: Such struggles often involve strategies and tactics of unconventional warfare, the'weaker' combatants attempting to use strategy to offset deficiencies in quantity or quality''.


Input: According to the aforementioned report to the House Armed Service Committee,'' Cyber warfare is an important asymmetric dimension of conflict that North Korea will probably continue to emphasize-in part because of its deniability and low relative costs.


Input: '' North Korea's poor economic state, further explains the regime's reliance on these tactics.


Input: In 2014, the regime reportedly spent 16% of its budget on defense.


Input: The North Korean military places a strong emphasis on information warfare capabilities including political and psychological warfare and cyber or hacker warfare.


Input: The report by Capt.


Input: Duk-Ki Kim, Ph.D. highlighted North Korea's counter-asymmetric strategy and ranked each based on intensity and frequency: Just ten years ago, experts noted that North Korea was one of the'' least network-ready and most isolated societies on the planet.


Input: '' Today North Korea's air-gapped networks and prioritization of resources for military use provide both a secure and structured base of operations for cyber operations and a secure means of communications.


Input: North Korea's hermit infrastructure creates a cyber-terrain that deters reconnaissance.


Input: Because North Korea has few Internet connections to the outside world, anyone seeking intelligence on North Korea's networks has to expend more resources for cyber reconnaissance.


Input: A 2003 article by the U.S. Office of the National Counterintelligence Executive assessed that'' Development of the nation, rather than empowerment of the individual, appears to be driving DPRK efforts to develop domestic IT infrastructure and industry.


Input: '' In November 2013, Kim Jong Un referred to cyber warfare capabilities as a'' magic weapon'' in conjunction with nuclear weapons and missiles.


Input: According to Kim Heung-kwang, a North Korean defector and former computer science professor, the regime has the following motivations for expanding its cyber warfare capabilities:  Cyber capabilities are a cost-effective way to offset North Korea's lack of kinetic military prowess.


Input:  North Korea's school systems place a strong emphasis on math, giving the nation confidence in its programmers, cryptographers, and security researchers.


Input:  In the modern warfare landscape, cyber capabilities are potentially more utilitarian than heavy artillery or aircraft.


Input:  Cyber warfare capabilities provide a platform for espionage, psychological operations, and other forms of non-kinetic warfare.


Input:  Considering the separatist nature of North Korea's infrastructure, cyber warfare provides a strategic advantage since outbound attacks are possible, but inbound attacks would have limited reach.


Input:  Cyber warfare allows North Korea to leverage the Internet's inherent flaws for offensive purposes while maintaining its defenses, primarily via air-gapping its most critical networks from the outside world.


Input: North Korea's attack and defense capabilities reportedly include the following cyber warfare and electronic warfare components: offensive cyber operations (OCO); computer network operations (CNO), which includes both computer network attack (CNA) and computer network exploitation (CNE); distributed denial of service (DDoS); satellite monitoring; drones; GPS jamming capabilities; and deployment of electromagnetic pulse (EMP).


Input: North Korea's OCO and CNO capabilities became apparent as early as 2004, when North Korea reportedly gained access to 33 of 80 South Korean military wireless communication networks.


Input: In June 2006, an attack on the U.S. State Department originating in the East Asia-Pacific region coincided with U.S.-North Korea negotiations over the regime's nuclear missile testing.


Input: A month later, a South Korean military report implicated North Korea's Unit 121 in hacking the South Korean and U.S. Defense Departments.


Input: North Korea also tested a logic bomb in October 2007.


Input: A logic bomb is malicious code programmed to execute based on a pre-defined triggering event.


Input: Following the logic bomb test, the UN passed a resolution banning sales of certain computer hardware to North Korea.


Input: North Korea considers its cyber warfare capabilities an important asymmetric asset in the face of its perceived enemies, the U.S. and South Korea.


Input: While North Korea does not have an immersive digital culture, both the U.S. and South Korea are heavily dependent upon technological infrastructure for social, economic, and political stability.


Input: For this reason, a cyber attack that cripples or compromises the reliability of the U.S. or South Korea's technological infrastructure could have a far-reaching impact.


Input: North Korea has reportedly used computer games for both illegal capital gain and orchestrating cyber attacks.


Input: In 2011, South Korean police arrested five individuals, including one Chinese national, for allegedly collaborating with North Korean hackers affiliated with the Korea Computer Center to steal money via online games.


Input: According to South Korean reports, the culprits used an auto-player to quickly progress in the massively multiplayer online role-playing game (MMORPG)'' Lineage'' and were able to use the game's market to obtain real currency.


Input: In 2013, South Korean officials released information stating they had found evidence that North Korea was using games as a medium for infecting machines and launching cyber attacks.


Input: North Korea had used game downloads to infect 100,000 South Korean machines for a botnet used to launch a distributed denial of service (DDoS) attack against Incheon Airport.


Input: This clever tactic sought to leverage a seemingly innocent game as a force multiplier in order to amplify the effects of a DDoS attack on a critical infrastructure target.


Input: However, in this case, there was little impact on the target.


Input: North Korea's intelligence program is one of its strongest military assets, providing foundational support for all other military operations.


Input: The regime's cyber warfare capabilities, in particular, rely heavily on open-source intelligence (OSINT) collection and cyber-espionage.


Input: As noted in a CIA publication,'' It is a significant irony of our information age that open-source intelligence is contributing to the survival and development of one of the world's most secretive regimes.


Input: '' Historically, the primary goals of the regime's intelligence program included collection and dissemination of intelligence concerning any possible political, military, or economic threat to the regime's security and stability.


Input: Secondary goals have included'' acquisition of foreign military and civilian technologies and equipment, support of the DPRK's foreign policy goals, training and support for foreign revolutionary and terrorist organizations, and the acquisition of foreign capital for state and intelligence operations.


Input: '' North Korea has a broad reach for intelligence collection, which extends to cyber intelligence.


Input: In April 2013, Solutionary, a company providing managed security services, reported a marked increase in both overt attacks and information gathering attempts originating from North Korean IPs.


Input: Solutionary refers to any overt external attacks on company networks or attempts to steal data as'' touches.


Input: '' They reportedly recorded 12,473 of these touches in February 2013, 11,000 of which were directed at a single financial institution.


Input: As a baseline, Solutionary noted that typically only 200 incidents per month are traced to North Korean origin.


Input: This is an interesting claim, considering that attacks attributed to North Korea are usually routed through other countries.


Input: As mentioned above, a faction of ethnic North Koreans residing in Japan, known as the Chongryon, are critical to North Korea's cyber and intelligence programs and help generate hard currency for the regime.


Input: The Chongryon headquarters has been recognized as the de facto North Korean embassy in Japan.


Input: In 2012, the organization's headquarters was seized to pay for the group's past due debts.


Input: It was then purchased by a monk named Ekan Ikeguchi, who let the Chongryon continue to use the building in what he referred to as a'' goodwill gesture''.


Input: Ikeguchi is one of the Chongryon's many ties to organized crime.


Input: Ikeguchi was arrested in the past for an attempted coup against the Japanese government.


Input: He also has ties to the political group Nihon Seinensya, which is involved in illegal activities in conjunction with the yakuza syndicate Sumiyoshi-kai, which imports and sells amphetamines made in North Korea.


Input: North Korea also has black market ties to Sumiyoshi-kai's rival syndicate, Yamaguchi-gumi.


Input: Many members of the Kodo-kai, Yamaguchi-gumi's ruling faction, are Korean-Japanese, with ties to North Korea.


Input: Masahiro Namikawa, leader of the drug trafficking Seido-kai yakuza organization, also has ties to the Chongryon.


Input: The Chongryon operate at least two websites, chongryon.com, which is in Japanese, and korea- np.co.jp.


Input: WHOIS records for chongryon.com indicate that it was registered by'' guanin o'' using the email address park2 @mac.com.


Input: The WHOIS information for korea-np.co.jp.


Input: shows that it was registered by Choson Shinbo Company Inc.


Input: The WHOIS records for these sites can be found in Appendix A. Additionally, the Chongryon operate a ferry called the Mangyongbong-92, the only direct transit from Japan to North Korea.


Input: In 2003, they were suspected of using the ferry to smuggle missile parts.


Input: In 2006, the ferry was temporarily banned from Japanese waters when Japanese officials discovered the Chongryon were using it to smuggle dual-use electronics to North Korea to be used for military purposes.


Input: North Korea has a global network of state-run businesses located in 30 to 40 countries that is used for espionage activities.


Input: The Reconnaissance General Bureau is responsible for oversight of this network.


Input: The businesses include cafes and other non-suspect establishments.


Input: The highest concentration of these is in China.


Input: Members of this espionage network reportedly'' send more than $100 million in cash per year to the regime and provide cover for spies.


Input: '' These establishments are also used for money laundering and drug trafficking.


Input: The regime is also known to kidnap foreign citizens and use them as instruments for intelligence.


Input: Prisoners are first tortured and psychologically conditioned to bend to the regime's will.


Input: They are then used based on their skillset.


Input: This may include teaching their language to North Koreans, spreading propaganda in their native language, providing translation services, conducting military training, or other skills the regime deems useful.


Input: In July 2014, Japanese officials agreed to lift some sanctions on North Korea when the regime agreed to investigate the whereabouts of Japanese citizens who were allegedly abducted by North Korean agents decades ago.


Input: Sanctions to be lifted include the ban on port calls to Japan by North Korean ships.


Input: North Korea has also infiltrated important positions in South Korea for both intelligence and psychological operations purposes.


Input: In 2011, South Korea's National Intelligence Service reportedly discovered the presence of Communist spies.


Input: These spies within their trusted circles had been reporting back to North Korea for almost 10 years.


Input: The embedded spies included a Democratic Party representative.


Input: According to the agency, the spies were on a mission to infiltrate and influence the Democratic Party and to gather military intelligence.


Input: The regime also attempts to infiltrate organizations made up of North Koreans who seek shelter in South Korea, in order to gain intelligence.


Input: In the past several years, South Korea has arrested at least 14 defectors who were found to be spies.


Input: These intelligence collection and counterintelligence capabilities are an attempt to provide the regime with a strategic asymmetrical advantage.


Input: The regime leverages its human and cyber resources around the globe to provide an influx of intelligence, while very little credible intelligence about the regime's activities and capabilities ever becomes available to the outside world.


Input: North Korea continues to be a master of propaganda and deception and leverages the cyber realm for psychological operations.


Input: Modern North Korean psychological operations tactics include distribution of propaganda via traditional media outlets, websites, and social media.


Input: Many of these psychological operations campaigns are politically focused.


Input: According to Dr. Andrei Lankov, the North Korean government has'' very rational and highly successful manipulators who usually get what they want by outsmarting everybody else in the process.


Input: '' The regime's Unit 204 is responsible for cyber-psychological operations.


Input: These operations are PSYOP tailored for the cyber arena.


Input: In order to be successful, cyber- psychological campaigns require speed, precision, and creativity.


Input: These campaigns leverage the phenomenon of viral, unverified news stories that tend to rapidly propagate via social media, mobile text messaging, and other electronic communications.


Input: This phenomenon creates an arena for strategic propagation of both fact and fiction for the purposes of sentiment manipulation.


Input: Such messages may be used for recruitment, cyber mobilization, and to instill fear in a target population.


Input: Cyber-psychological operations may also include mental suggestion using technology as a delivery mechanism for subliminal cues.


Input: It is unknown whether North Korea possesses this capability.


Input: North Korean citizens have access to state-approved social networks on the Kwangmyong.


Input: The regime has a limited overt social media presence on the Internet.


Input: Some of the known social media platforms employed by the regime include Twitter, Facebook, and YouTube.


Input: The YouTube channel North Korea Today, operated by user rodrigorojo1, features news clips from North Korea.


Input: It is unclear whether this channel is officially sanctioned.


Input: The North Korea Today YouTube channel also has corresponding profiles on Twitter and Facebook.


Input: The Uriminzokkiri website, known for pushing juche ideology and anti-American and anti-South Korean messages, has accompanying social media profiles on YouTube, Google+, and Facebook.


Input: It also has Twitter profiles in both Korean and English.


Input: North Korean propaganda is used for several purposes: to enforce the ideals of allies and sympathizers, to frame North Korea in a favorable light to outsiders, to sensationalize the regime's perceived self-reliance and military prowess, and to shield its own citizens from the outside world.


Input: Juche ideology and indoctrination of the regime's youth ensure support of the local population.


Input: North Koreans accept military duty as an honor and strive to excel in their service to the regime.


Input: In the spirit of juche, the regime uses disinformation to'' hide lapses or tout accomplishments that may have never been achieved.


Input: '' Limiting citizen access to the outside world by instituting the Kwangmyong intranet, North Korea ensures its citizens are not exposed to outside information that is counterproductive to citizen indoctrination or in conflict with juche ideals.


Input: North Korea portrays the West, particularly the United States, as an enemy.


Input: The regime uses this strategy of shifting the population's negative sentiments toward an external entity to keep its citizens ignorant of North Korea's own economic hardship, regime brutality, and systemic incompetence.


Input: For example, prior to Kim Jong Il's death in 2011, North Korean media altered photos of their'' Dear Leader'' to make him appear younger and healthier than he really was.


Input: This became obvious when the altered photos were compared to those taken by Western media around the same time.


Input: According to Dr. Andrei Lankov,'' North Koreans now have a much better understanding of what is going on in the outside than they did before.


Input: This is largely thanks to the spread of DVDs and video content in the country, but also because some of them have been to China and talk about what they have seen…many [of] them sincerely believe that the United States remains ready to attack at any moment and that Japan is an incurably aggressive place…nearly all of them swallow the official propaganda myths about the Korean War being started by the'American Imperialists' who invaded them.


Input: Hence, they see the outside world as an inherently dangerous place.


Input: '' Some human rights groups seek to reach out to North Korean citizens and break them from this isolation.


Input: In August 2014, the New York-based charity Human Rights Foundation sponsored a hackathon in San Francisco called'' Hack North Korea'' to find new ways to get information in, out, and around North Korea.


Input: The event brought together many programmers, human rights campaigners, and defectors.


Input: North Korea even uses'' trolling'' as a PSYOP tactic.


Input: On the Internet,'' trolls'' are users who post messages that are often crass, controversial, inflammatory, or offensive, in order to evoke a strong reaction or influence a reader's opinion.


Input: Often, the motivation for trolling is simply for the troll's enjoyment.


Input: The rude and offensive trolling tactics are in stark contrast to traditional forms of persuasive rhetoric.


Input: However, North Korea reportedly utilizes over 200 military intelligence operatives to troll South Korean message boards and social media pages with pro-North Korean sentiments. < /fn > Matt Rhoades, director of the cyberspace and security program at the Truman National Security Project, said,'' North Korea's cyber-development is almost just a new harassment mechanism for them, a low-cost, asymmetric method to harass its neighbor in the south…'' Leveraging the cyber and intelligence resources noted above, North Korea's psychological operations serve an important strategic role.


Input: The ability to influence outsiders, while effectively isolating its own population from most outside influence, allows North Korea to remain an enigma.


Input: Additionally, in line with its PSYOP tactics, North Korea may strategically take credit for cyber attacks that were, in reality, launched by another entity.


Input: Whether the targeted entity blames North Korea for the attacks, or the regime simply takes credit for an attack that has not yet been attributed, several PSYOP goals can come into play.


Input: First, to claim credit for an attack amplifies the impact of a show of force, particularly if South Korea is the target.


Input: This tactic can be used to stir sentiments in order to provoke a reaction.


Input: Second, North Korea may lay claim to responsibility for an attack that exceeds its capabilities in order to seem more technologically advanced and more capable.


Input: Third, any success, or the appearance thereof, enforces the juche ideal of regime self-sufficiency.


Input: Finally, North Korea may act as a scapegoat and claim credit for a cyber attack of an ally such as China so the attack is not attributed to the real actors.


Input: North Korea reportedly has the electronic warfare capabilities to jam GPS and to inject false GPS coordinates.


Input: North Korea demonstrated these capabilities in March 2011 by jamming South Korea's GPS signals during a joint U.S.-South Korea military exercise.


Input: North Korea has the capability to create an EMP.


Input: An EMP is a sudden, extreme outburst of atmospheric electricity creating an intense magnetic field that can burn out electrical equipment.


Input: A report from the U.S. Department of Homeland Security (DHS) noted North Korea's ability to deliver a nuclear warhead as a satellite over the South Pole, effectively creating the burst needed to deliver an EMP targeting the United States.


Input: An EMP could effectively disrupt electronic communications including critical infrastructure components such as telecommunications, financial institutions, the energy sector, transportation, food and water delivery, emergency services, and space systems.


Input: North Korea reportedly acquired its EMP technology from Russia.


Input: North Korea also has a drone program.


Input: The regime reportedly acquired its first drones in the late 1980's or early 1990's.


Input: The regime's drones are complimentary to its intelligence program and are primarily used for surveillance.


Input: In early 2014 a North Korean drone crashed south of the 38th parallel, the line dividing North Korea from the south.


Input: While early reports noted that the drones appeared similar to those manufactured by Chinese company Tauyuan Navigation Friend Aviation Technology, the company denied involvement.


Input: Stressing the importance of the regime's electronic warfare capabilities, in 1999 former regime leader Kim Jong Il said'' The basic key to victory in modern warfare is to do well in electronic warfare.


Input: '' Since the regime's advanced technology lags behind that of South Korea and the U.S., its capability to disrupt the communications of these perceived adversaries is a vital asymmetric capability.


Input: North Korea utilizes primary and secondary education and the university system to train its cyber warfare operators.


Input: According to reports by defectors, the regime seeks out children who show mathematical talent and sends them through rigorous advanced training.


Input: A vintage North Korean animation stresses the importance of mathematics in North Korean education.


Input: The short film follows a young boy as he does his geometry homework.


Input: The frustrated boy begins to daydream then has visions of going to war with the U.S. and needing geometry to effectively calculate missile trajectory during the battle.


Input: Science and technology students are expected to learn foreign languages, which may include Chinese, Japanese, and English.233 Student emails, chats, and web browsing activities are heavily monitored.


Input: Around age twelve or thirteen, chosen students are enrolled in accelerated computer courses at First and Second Geumseong Senior-Middle Schools.


Input: The successful students are then sent to Kim Il-sung University, Kim Chaek University of Technology, or the Command Automation University, traditionally known as Mirim University.


Input: Kim Il-sung University's computer center was started in 1985.


Input: Its computer courses have a heavy programming element.


Input: The university reportedly developed the Intelligent Locker hard disc protection program, Worluf Antivirus, SIMNA (simulation and system analysis program), a war games program, a hepatitis diagnosis and prescription system, and a C++ program development tool called FC 2.0.


Input: Kim Il-sung University also has programs focusing on nuclear research.


Input: Kim Chaek University of Technology was established in 1948.


Input: In the late 1990s, it began to restructure its computer-focused courses to reflect more modern technologies.


Input: As of 2002, the university had three colleges focusing on computer science, information science and technology, and machine science.


Input: Software developed by the university includes Computer Fax and SGVision, an image-reprocessing program used for steganography.


Input: Students and instructors must submit a formal request for permission in order to use the Internet for research.


Input: The Command Automation University periodically chooses around 100 students for an intensive five-year course prior to their assignment to serve in cyber intelligence and cyber warfare capacities.


Input: Programs at the Command Automation University include command automation, computers, programming, automated reconnaissance, and electronic warfare.


Input: Other students attend a two-year accelerated university program, then study abroad in Russia or China before they are assigned to a cyber-operator role.


Input: The elite cyber operators are given special incentives.


Input: For example, parents of students graduating from the cyber program with top scores are given the opportunity to live in Pyongyang; and married cyber operators are given housing, a food allowance, and a stipend if operating overseas.


Input: Due to the nature of their profession, these cyber elite are some of the only North Koreans allowed to access the outside Internet.


Input: While this report focuses on North Korea's cyber warfare capabilities, these capabilities can not be fully separated from the implications of partnerships with countries known to deal in illegal weapons trade with the regime.


Input: Now that cyberspace has become a legitimate arena for warfare, these nations are also potential allies in the cyber realm.


Input: For this reason, the regime's key political and military relationships are explored below.


Input: North Korea has a longstanding historical relationship with China.


Input: During the Korean War (1950- 1953), China allied with North Korea's Communist forces.


Input: China has also provided ongoing political and economic support to the regime's leadership and is a primary trade partner.


Input: North Korea is economically dependent on China.


Input: North Korea gets an estimated 90 percent of its energy imports, 80 percent of its consumer goods, and 45 percent of its food supply from China.


Input: This relationship is prudent–in the event of a military conflict, China can strategically use North Korea as a buffer zone between itself and South Korea, where many U.S. military personnel are stationed.


Input: Chinese aid to North Korea also deters the likelihood that the regime will collapse, resulting in internal destabilization that could catalyze a U.S.-China conflict.


Input: North Korea relies heavily on China for technological resources.


Input: As noted above, North Korea relies on China's Unicom for Internet access.


Input: Additionally, the regime sends some of its cyber warriors to train in China and stations a portion of its Unit 121 personnel in Shenyang.


Input: Some of North Korea's official websites are hosted in China, and KCC has a branch office there.


Input: North Korea also relies on China to provide much of its network hardware, including servers and routers.


Input: North Korea has a long history of ties to Russia.


Input: The former Soviet Union was the major sponsor of the North Korean state and a major trading partner.


Input: Following the dissolution of the Soviet Union, aid to North Korea was halted and trade diminished significantly.


Input: This chain of events contributed to North Korea's eventual economic collapse, as it could not survive without aid.


Input: North Korea currently has a collaborative relationship with Russia in the cyber realm.


Input: The regime's CSTIA relies on Russia as one of several sources for technical data.


Input: North Korea also sends some of its cyber warriors to train in Russia, and the regime reportedly acquired its EMP technology from there.


Input: Political ties between Russia and North Korea have become stronger in recent months.


Input: In 2014, potentially as a result of the U.S. response to the Russian-Ukranian conflict, Russia began to strengthen ties with North Korea.


Input: Negotiations reportedly included promises of trade and development projects.


Input: Narushige Michishita, a North Korea and Asia security expert at Japan's National Graduate Institute for Policy Studies, stated'' By strengthening its relationship with North Korea, Russia is trying to enhance its bargaining position vis-à-vis the United States and Japan.


Input: '' Russia also recently forgave most of the regime's debts.


Input: North Korea and Iran have longstanding political and military ties.


Input: North Korea supplied Iran with conventional arms during the Iran-Iraq War.


Input: Iran and North Korea reportedly collaborate closely in ballistic missile development efforts.


Input: In the past, Iran provided the North Korean regime with necessary funds and oil in exchange for missile parts and technology.


Input: In 2009, a North Korean plane transporting 35 tons of weapons and allegedly bound for Iran was seized after making an unscheduled stop in Bangkok, Thailand.


Input: That same year, United Arab Emirates seized a ship bound for Iran that was transporting several containers of North Korean weapons, including rocket-propelled grenades and ammunition.


Input: Reportedly, the customer was a company affiliated with Iran's Islamic Revolutionary Guard Corps.


Input: North Korea also has cyberwar ties with Iran.


Input: In 2012, North Korea and Iran signed a technology treaty to help combat'' common enemies'' in cyberspace.


Input: The treaty included provisions for cooperation in research, student exchanges, and joint laboratories.


Input: Joint projects reportedly include IT information sharing, engineering, biotechnology, renewable energy, and sustainability.


Input: F-Secure's Mikko Hypponen stated,'' It's highly likely that one of the reasons for this co-operation is for them to work together regarding their cyber defence and cyber offense strategies''.


Input: Hypponen cited Flame malware as a possible triggering event for the creation of this treaty.


Input: Others also suspect that Iran and North Korea's mutual interest in development of nuclear weapons and the need to protect refineries against malware such as Stuxnet were driving factors in the establishment of the treaty.


Input: U.S. House Foreign Affairs Committee leaders assert that the treaty indicates North Korea and Iran are collaborating on a joint nuclear weapons program.


Input: Additionally, North Korea, in conjunction with Iran and Syria, reportedly supports both Hamas and Hezbollah in procuring kinetic weaponry and communications equipment and in establishing operational infrastructure.


Input: North Korea has both a cyber relationship and kinetic weapons ties with Syria.


Input: KCC reportedly has a branch in Syria.


Input: In 2007, Israel launched an airstrike, destroying a Syrian target that was allegedly a nuclear facility under construction with North Korea's assistance.


Input: U.S. officials noted the facility was modeled on the North Korean nuclear reactor at Yongbyon.


Input: The North Korea-Syria relationship becomes more important in the context of both countries' ties with Iran.


Input: As noted above, Iran, North Korea, and Syria jointly provide support to extremist groups Hamas and Hezbollah.


Input: Additionally, as we explored in HPSR Security Briefing Episode 11, Iran and Syria's military alliances extend to joint SIGINT and cyber operations.


Input: North Korea also has an interesting relationship with Cuba–one that includes supplying weapons and apparent attempts to illegally smuggle weapons.


Input: In 2013, a North Korean cargo ship on its return voyage was stopped near the Panama Canal.


Input: The ship was carrying surface-to-air missile parts, disguised as containers of sugar.


Input: In an attempt to save face, Cuba's Ministry of Foreign Affairs stated that the cargo included'' 240 metric tons of obsolete defensive weapons -- two anti- aircraft missile complexes Volga and Pechora, nine missiles in parts and spares, two Mig-21 Bis and 15 motors for this type of airplane, all of it manufactured in the mid-20th century -- to be repaired and returned to Cuba.


Input: '' Experts said the cargo appeared to include a SNR-75 Fan Song fire-control radar system for an SA-2 missile, a Soviet-era missile system that was also used in Cuba.


Input: Following the incident, Fidel Castro credited former North Korean leader Kim Il-Sung for providing Cuba with weapons near the end of the Cold War.


Input: Weapons included 100,000 AK rifles and necessary ammunition.


Input: While no apparent cyber relationship exists between North Korea and Cuba at this time, their track record for weapons trade means the potential for future collaboration in the cyber realm can not be discounted.


Input:  North Korea gains access to 33 South Korean military wireless communication networks  The U.S. State Department is attacked by entities in the East Asia-Pacific region.


Input: The attacks coincided with State Department negotiations with North Korea regarding the regime's nuclear missile tests.


Input: (June)  A South Korean military official states North Korea's Unit 121 has breached South Korean and U.S. military entities.


Input: (July)  North Korea states that it is'' fully ready for any form of high-tech war.


Input: '' (June)  DarkSeoul DDoS and disk wiping malware targeting South Korean and U.S. government, media outlet, and financial websites.


Input: These attacks also coincided with U.S.


Input: Independence Day.


Input: (July)  Malware for'' Operation Troy'' was likely planted.


Input: It is interesting to note that much of North Korea's cyber activity follows a distinct pattern.


Input: Analysis of North Korean cyber activity gives insight into these patterns and also helps tie together North Korea's strategic, tactical, and operational capabilities.


Input: Strategic capabilities refer to the assets used in support of a long-term, overarching goal.


Input: Tactical capabilities refer to the methods and maneuvers actually implemented in pursuit of the strategic goal.


Input: Operational capabilities refer to the potential use of these capabilities.


Input: In 2004, in response to the annual U.S.–South Korea joint military exercises, North Korea reportedly gained access to 33 South Korean military wireless communication networks.


Input: The next significant cyber attack attributed to North Korea was in June 2006.


Input: The U.S. State Department was attacked by entities in the East Asia-Pacific region.


Input: The attacks coincided with State Department negotiations with North Korea regarding the regime's nuclear missile tests.


Input: In July 2006, North Korea's Unit 121 reportedly breached South Korean and U.S. military entities.


Input: This attack was concurrent with the regime's test-fire of at least one long-range missile and several medium-range missiles.


Input: 2007 was politically tumultuous for North Korea.


Input: Following multi-national talks, the UN's International Atomic Energy Agency (IAEA) ordered the shutdown of the regime's nuclear facilities in Yongbyon in July.


Input: Its nuclear efforts temporarily thwarted, North Korea tested a logic bomb in October 2007.


Input: In April 2009, North Korea ejected IAEA and U.S. nuclear compliance officials.


Input: The regime indicated refusal to comply with any UN agreements regarding nuclear weaponry and announced it would reinstate its nuclear materials production.


Input: The next month, North Korea conducted an underground nuclear test and voiced its confidence that the regime was well on its way to producing viable nuclear technology.


Input: The UN called an emergency meeting condemning the nuclear weapons test, and South Korea joined the Proliferation Security Initiative (PSI).


Input: North Korea issued a statement via KCNA calling South Korea's involvement in PSI an act of war.


Input: In June 2009, North Korea stated that it was'' fully ready for any form of high-tech war.


Input: '' The following month, DDoS and disk wiping malware, later known as DarkSeoul, targeted South Korean and U.S. government entities, media outlets, and financial websites.


Input: The attacks coincided with U.S.


Input: Independence Day.


Input: Other malware used for Operation Troy was also planted.


Input: Operation Troy would continue for several years, largely undetected.


Input: In early 2011, political and military tensions were high.


Input: In February, James Clapper, United States Director of National Intelligence, testified that North Korea likely had undeclared uranium enrichment facilities as part of its nuclear weapons program.


Input: In March 2011, South Korean media, financial, and critical infrastructure targets suffered a DDoS and disk-wiping malware attack later known as the'' 10 Days of Rain''.


Input: U.S. and South Korean military entities were also targeted by DDoS during this attack.


Input: The attack used the DarkSeoul malware.


Input: North Korea also disrupted South Korean GPS signals.


Input: Additionally, North Korean actors reportedly attempted a DDoS attack against South Korea's Incheon Airport that same month.


Input: These incidents coincided with the annual U.S.–South Korea joint military exercises.


Input: The following month, North Korean actors reportedly launched a DDoS attack against South Korea's Nonghyup bank.


Input: In 2012, an attack on South Korean Newspaper JoongAng Ilbo was attributed to North Korean actors.


Input: This attack also coincided with the timing of the annual joint U.S.–South Korea military exercises.


Input: In September 2012, North Korea signed a cyber treaty with Iran, agreeing the two nations would collaborate to combat'' common enemies'' in cyberspace.


Input: The week of March 11, 2013, the U.S. and South Korea began their annual joint military exercise near the Korean Peninsula.


Input: Like clockwork, attacks attributed to North Korea and now known as the March 20 attacks targeted three South Korean media outlets and Shinhan, Nonghyup, and Jeju banks.


Input: North Korea also exhibited other hostile activity at that time.


Input: North Korea cut communication with Seoul and announced it had scrapped the 1953 armistice between the two Koreas.


Input: North Korea's foreign ministry also issued a statement that it perceived this exercise as a precursor to invasion and that the regime would respond with a'' strong military counteraction'' if the situation escalated.


Input: That same week, the North Korean military conducted a drone attack simulation.


Input: On March 18, the Uriminzokkiri YouTube channel posted an anti-U.S. video entitled'' Firestorms Will Rain on the Headquarters of War'' that showed a depiction of the White House in crosshairs, followed by an explosion.


Input: In May 2013, DarkSeoul malware was used to attack several South Korean financial institutions; and in June, DarkSeoul DDoS attacks were launched against the South Korean government's DNS server.

DarkSeoul DDoS attacks

the South Korean government's DNS server

were launched

against


Input: The latter took place on June 25, the anniversary of the start of the Korean War.


Input: As evidenced above, much of North Korea's cyber activity coincides with the annual U.S.–South Korea joint military exercises.


Input: Attacks not following that pattern were typically in response to political events impacting the regime or correlated with significant dates, such as the anniversary of the start of the Korean War.


Input: The regime's strategic assets and tactical capabilities in the cyber arena seem to have evolved only slightly since 2009.


Input: Most of the attacks attributed to North Korea employ limited tactics, and their operational capability demonstrates an increase in the frequency and volume of attacks but is otherwise unimpressive to date.


Input: In June 2014, the regime demanded cancellation of the annual U.S.-South Korea joint military exercise, attempting to use participation in the upcoming Asian Games as a bargaining chip.


Input: The regime's demands may have had other political motivations, as they preceded the July 2014 meeting between South Korean president Park and Chinese President Xi Jinping.


Input: The meeting centered on trade and regional security issues, including the ever-present rhetoric around denuclearization of North Korea.


Input: Both leaders were critical of Japan's recent announcement to soften sanctions on North Korea.


Input: As this report headed to press, the annual U.S.–South Korea joint military exercises were underway.


Input: The most prominent North Korean threat actor group is the group responsible for the DarkSeoul malware.


Input: According to statements from the South Korean government, North Korea's Lab 110 were the actors behind the DarkSeoul malware.


Input: South Korean intelligence reports stated that Lab 110, which is affiliated with the regime's defense ministry, was ordered by the North Korean regime to destroy South Korean communications networks.


Input: Although the March 20 attacks used DarkSeoul malware, it is interesting to note that two groups, WhoIs Team and New Romantic Cyber Army Team, claimed responsibility for the'' March 20'' 2013 attacks on South Korean media and financial institutions.


Input: Some of the DarkSeoul attacks corresponded with significant dates, such as U.S.


Input: Independence Day or the anniversary of the start of the Korean War.


Input: DarkSeoul attacks go beyond denial of service and sabotage.


Input: As early as 2009, the group responsible for the Dark Seoul attacks launched'' Operation Troy'', an espionage campaign targeting the South Korean military.


Input: The operation was codenamed'' Troy'' due to the frequent use of the word'' Troy'' in the malware's compile path strings.


Input: The malware used in these attacks sought out and exfiltrated data, based on keyword searches.

The malware used in these attacks

data

sought out

exfiltrated


Input: While the malware was clearly intended to search for and exfiltrate certain types of data, its true impact on the targets was never revealed.

the malware

certain types of data

search

exfiltrate

for


Input: The March 2011'' 10 Days of Rain'' DDoS attacks on U.S. and South Korean sites have also been attributed to the actors associated with DarkSeoul.


Input: According to Symantec, the politically motivated attacks have required a level of intelligence, coordination, monetary support, and technical sophistication that suggests state sponsorship.


Input: This designation means the group can be considered an advanced persistent threat (APT).


Input: A March 20, 2013 attack attributed to the DarkSeoul actors targeted three South Korean media outlets and Shinhan, Nonghyup, and Jeju banks.


Input: The impact of the March 20 attacks included disruption of service at financial institutions and data deletion.

the March 20 attacks

disruption of service at financial institutions

data deletion

included


Input: However, the targeted entities resumed normal operations shortly thereafter.


Input: According to South Korean reports, the media outlets targeted corresponded with those listed by the North Korean regime in 2012 as right-wing press that manipulated South Korea's public opinion.


Input: In April 2012, the regime reportedly listed those entities as attack targets.


Input: The malware used in the March 20, 2013 attacks were wiper malware.

The malware used in the March 20, 2013 attacks

wiper malware

were


Input: The malware attempted to disable AhnLab and Hauri AV antivirus products then proceeded to overwrite the master boot record (MBR).

The malware

AhnLab and Hauri AV antivirus products

the master boot record (MBR)

disable

overwrite


Input: The attack was capable of wiping both Linux and Windows machines.

The attack

both Linux and Windows machines

wiping


Input: McAfee found that these attacks were the culmination of the malware campaign they dubbed'' Operation Troy''.


Input: A report from IssueMakersLab tied the actors responsible for the March 20, 2013 attacks to cyber attack activity occurring as early as 2007.


Input: IssueMakersLab found that these actors consistently used the same 16-digit password for file compression, the same stage 1 C2 protocol, the same collection keywords and encryption keys, and the same development path.

these actors

the same 16-digit password

file compression

the same stage 1 C2 protocol

the same collection keywords and encryption keys

used

for


Input: According to South Korea's Korea Internet and Security Agency, the North Korean IP address 175.45.178.xx was found scanning South Korean routes the month before the attacks, and the same IP was reportedly logged as accessing one of the targets 13 times.

the North Korean IP address 175.45.178.xx

South Korean routes

scanning


Input: Details of the March 20 attack also suggested possible ties to China.


Input: AlienVault suspected the Chinese exploit kit GonDad was used to spread the malware, and the Korean domains serving the malware were registered using a Chinese email address.

the Chinese exploit kit GonDad

the malware

spread


Input: Additionally, researchers at AhnLab in South Korea noted a Chinese IP address linked to the attacks.


Input: While no concrete evidence has been released that indicates Lab 110 was responsible for the DarkSeoul attacks, the responsible group's targets, TTP, and attack timing demonstrate a strong pro-North Korean sentiment.


Input: Known tactics, techniques and procedures Targets WhoIs Team is one of two groups that claimed responsibility for the'' March 20'' attacks targeting South Korea.


Input: A defacement on the LG +U webpage stated that it was'' Hacked by WhoIs Team'' and that the attackers would return.


Input: The page featured three skulls.


Input: However, no other attacks by WhoIs Team have been observed.


Input: Known tactics, techniques, and procedures Targets Associated actors Based on North Korea's affinity for disinformation and counterintelligence, we must note the distinct possibility that operatives claiming to be WhoIs Team are part of another group and that the defacement was a false flag operation meant to pin blame on RAONASRT.


Input: RAONASRT is a South Korean white hat capture the flag (CTF) team, whose members also operate under the name'' WhoIs''.


Input: l RAONASRT (the RaonSecure Advanced Security Research Team) and its sub-teams WhoIs Team and Cpark Team have participated in and performed well in CTF contests such as the one hosted by DefCon.


Input: In 2013, a member of RAONASRT was invited to Blue House, the residence of the South Korean president, to meet with president Park and discuss the security industry.


Input: RAONASRT runs the Secuinside CTF competition.


Input: Their parent organization RaonSecure operates a whitehat training program.


Input: The group also runs the Korea WhiteHat Contest, which is hosted by South Korea's Ministry of National Defense and National Intelligence Service and supervised by South Korean Cyber Command.


Input: For these reasons, it seems unlikely that the RAONASRT WhoIs Team would maliciously target South Korean entities.