DPRK Ransomware Activity

This joint Cybersecurity Advisory (CSA) by multiple U.S. and South Korean agencies aims to raise awareness about ongoing ransomware attacks against Healthcare and Public Health Sector organizations and critical infrastructure entities. It provides an overview of the state-sponsored ransomware activities carried out by the Democratic People's Republic of Korea (DPRK). The CSA highlights the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) used by DPRK cyber actors to infiltrate and target these organizations, along with their use of cryptocurrency for ransom demands. The advisory cautions against paying the attackers, instead providing a recovery script to reverse the effects of the malware.

‍