Suspected North Korean hackers target joint South Korea-US military drills

According to South Korean authorities, suspected North Korean hackers tried an attack on a major joint military drill between Seoul and Washington that begins on Monday.

South Korea and the United States will begin the annual Ulchi Freedom Shield drills on Monday and will last through August 31 to address the North’s rising nuclear threat.

Pyongyang regards such manoeuvres as drills for an invasion and has repeatedly warned that it will respond with “overwhelming” force.

The hackers — believed to be linked to a North Korean group dubbed Kimsuky — carried out “continuous malicious email attacks” on South Korean contractors working at the allies’ combined exercise war simulation centre, the Gyeonggi Nambu Provincial Police Agency said in a statement on Sunday.

“Police investigation confirms that North Korean hacking group was responsible for the attack,” it said in a statement, adding that military-related information was not stolen.

According to the statement, a combined investigation by authorities and the US military discovered that the IP address used in the new attack matched one revealed in a 2014 cyberattack on South Korea’s nuclear reactor operator blamed on the gang.

Kimsuky hackers utilise “spearphishing” methods to steal information from victims by delivering malicious attachments inserted in emails.

According to findings by the US Cybersecurity and Infrastructure Security Agency in 2020, Kimsuky is “most likely tasked by the North Korean regime with a global intelligence gathering mission.”

The organisation, which is thought to have been operating since 2012, targets people and organisations in South Korea, Japan, and the United States, with an emphasis on foreign policy and national security matters concerning the Korean peninsula, nuclear policy, and sanctions, according to the statement.