Microsoft Threat Intelligence Podcast North Korea Threat Landscape Update
Jan 24, 2024
Sherrod DeGrippo, Greg Schloemer, and Matthew Kennedy discuss North Korean cyber operations, emphasizing their persistence, adaptability, and revenue generation through cryptocurrency theft. They explore the actions of the Lazarus group and its impact on North Korean cyber operations. The speakers also highlight Diamondsleet's software supply chain attack and the success of the Jade Sleet group in cryptocurrency thefts. They discuss North Korea's mindset of evolution, diverse techniques employed in cyber operations, and challenges of laundering stolen money. The speakers share their interests in cybersecurity and hope for regular updates on North Korea.
AI Snips
Chapters
Transcript
Episode notes
APT Meets Cybercrime For Revenue
- North Korean operations blend APT persistence with cybercrime revenue goals, making them both espionage-focused and profit-driven.
- Lazarus and related clusters increasingly prioritize cryptocurrency theft as a state-directed funding mechanism for the regime.
Sony Attack Marked A Strategic Shift
- The 2014 Sony Pictures attack was a turning point that pushed North Korea into global attention by targeting a private company over a satirical film.
- That provocative action signaled a new willingness to strike symbolic non-state targets, shaping later operations.
Treat Signed Software As Potentially Malicious
- Monitor and respond quickly to software supply chain compromises because signed, legitimate apps can be weaponized to reach global users.
- Expect stolen code signing certificates, anti-reverse tricks, and timing logic like malware that runs only at specific times.