Advancing UK Aerospace, Defence, Security & Space Solutions Worldwide
  • Home
  • /
  • Security
  • /
  • NCSC and partners warn of DPRK-sponsored cyber ops

Security

NCSC and partners warn of DPRK-sponsored cyber ops

The National Cyber Security Centre (NCSC) – a part of GCHQ – issued a new advisory yesterday alongside partners in the US and the Republic of Korea, which reveals how a Democratic People’s Republic of Korea (DPRK) sponsored cyber threat group known as Andariel, has been compromising organisations around the world to steal sensitive and classified technical information and intellectual property data.

Image copyright Shutterstock

The NCSC assesses that Andariel is a part of DPRK’s Reconnaissance General Bureau (RGB) 3rd Bureau and that the group’s malicious cyber activities pose an ongoing threat to critical infrastructure organisations globally.  

The cyber actors have primarily targeted defence, aerospace, nuclear and engineering entities and organisations in the medical and energy sectors to a lesser extent, in order to obtain information such as contract specification, design drawings and project details.

Advertisement
Leonardo RT

As part of its operations, Andariel has also launched ransomware attacks against US healthcare organisations in order to extort payments and fund further espionage activity.

This advisory shares technical details and mitigation advice to help defend against the actors who have been seen exploiting known vulnerabilities to access victims’ systems before deploying malware and other tools to maintain persistence, evade detection and exfiltrate data.  

Paul Chichester, NCSC Director of Operations, said: “The global cyber espionage operation that we have exposed today shows the lengths that DPRK state-sponsored actors are willing to go to pursue their military and nuclear programmes.

“It should remind critical infrastructure operators of the importance of protecting the sensitive information and intellectual property they hold on their systems to prevent theft and misuse.  

“The NCSC, alongside our US and Korean partners, strongly encourage network defenders to follow the guidance set out in this advisory to ensure they have strong protections in place to prevent this malicious activity.”

Advertisement
DSEI 2025

The advisory outlines how Andariel has evolved its operations from conducting destructive attacks targeting US and South Korea organisations to conducting specialised cyber espionage and ransomware attacks.

It warns that in some cases the actors have even been observed launching ransomware attacks and espionage operations on the same day and leveraging both activities against the same victim.

The advisory has been co-sealed by the NCSC, the US Federal Bureau of Investigation (FBI), the US Cyber National Mission Force (CNMF), the US Cybersecurity and Infrastructure Security Agency (CISA), the US Department of Defense Cyber Crime Center (DC3), the US National Security Agency (NSA), the Republic of Korea’s National Intelligence Service (NIS) and the Republic of Korea’s National Police Agency (NPA).

It can be read on the FBI website: www.ic3.gov/Media/News/2024/240725.pdf
 

Advertisement
General Atomics LB
Value of aerospace, defence, security and space to UK up 64% in 10 years

Aerospace Defence Security Space

Value of aerospace, defence, security and space to UK up 64% in 10 years

16 June 2025

The UK’s aerospace, defence, security and space sectors added £42.2 billion to the UK economy in 2024, according to new data from ADS, equating to a 64% increase over the last decade.

Kahootz signs MAPP contract extention with MoJ

Security

Kahootz signs MAPP contract extention with MoJ

12 June 2025

British provider of secure online collaboration platforms, Kahootz, has signed a three-year contract extension with the Ministry of Justice (MoJ), marking a decade of continued Kahootz support for Multi-Agency Public Protection Arrangements (MAPPA).

NPAS opens Tactical Flight Officers recruitment 2025

Aerospace Security

NPAS opens Tactical Flight Officers recruitment 2025

12 June 2025

The National Police Air Service (NPAS) is now accepting applications for the role of Tactical Flight Officer (TFO) - a unique opportunity for substantive Police Constables to join the national air support team and take their careers to new heights.

Dstl trials underwater robot

Defence Security

Dstl trials underwater robot

11 June 2025

The Defence Science and Technology Laboratory (Dstl) has trialled an underwater robot which can prevent adversaries from sabotaging undersea cables and pipelines by disarming or removing threats.

Advertisement
ODU RT
Eclipse Digital Solutions creates custodial division

Security

Eclipse Digital Solutions creates custodial division

10 June 2025

Building on its responsibility to provide cost effective quality systems and services to the Ministry of Justice (MoJ), award-winning security solutions provider Eclipse Digital Solutions Ltd has created a custodial division, underpinning its commitment to the prison and probation and police sector.

BAE Systems and Hanwha Systems to develop multi-sensor satellite system

Defence Security Space

BAE Systems and Hanwha Systems to develop multi-sensor satellite system

10 June 2025

BAE Systems and Hanwha Systems have signed a Memorandum of Understanding (MoU) to develop technology and collaborative working to deliver an advanced multi-sensor satellite system for international markets.

Advertisement
ODU RT