North Korean Hacker Group Unveiled: APT45's Ransomware Campaign and Nuclear Targets

▌Use and Characteristics of BugSleep Malware

Recently, Sixun Security Lab has tracked APT45 actively launching ransomware attacks against healthcare providers, financial institutions, and energy companies, further clarifying the clues of this hacking group's operations.

APT45, a hacking group tracked for years as Andariel or Silent Chollima, is known for its cyber espionage operations supporting the strategic interests of the North Korean government. Recently, however, they have expanded their operations to launch data ransomware attacks against highly sensitive targets.

▌Multi-dimensional Attack Strategy of APT45

The group has been closely monitored by multiple government agencies worldwide to track its activities aimed at obtaining intelligence on defense and research and development, including how it targets information on conventional weapons and the latest weapon systems.

As North Korea seeks to manufacture more advanced missiles, groups like APT45 have stolen relevant blueprints for them. Unconstrained by ethics, the APT45 group has shown its willingness and capability to target any entity to achieve its goals, including healthcare, finance, energy, and various other organizations.

Although the group was first observed conducting espionage against government agencies and defense industries (primarily in South Korea), we have found that APT45 has expanded to economically motivated operations, including those targeting the financial sector.

▌Dual Threat of Ransomware and Nuclear Facilities

We believe APT45 has participated in ransomware development, and the hacker group has acted against nuclear-related organizations, highlighting its role in supporting the North Korean government.

In addition to launching ransomware attacks, the group has directly targeted nuclear research facilities and nuclear power plants, such as the Kudankulam Nuclear Power Plant in India. This is one of the few publicly known cases of North Korean cyber operations targeting critical infrastructure.

While we cannot confirm that ransomware is part of APT45's arsenal, the group has been engaged in financial crimes to fund its operations or generate revenue for the government. At the same time, our country must also remain alert to the fact that the hacker group is using specific ransomware to target the healthcare and public health sectors.

Like most North Korean hacking teams, APT45 malware has displayed unique shared characteristics over time, including code reuse, unique custom coding, and passwords. These characteristics provide defenders with clues to hunt for and identify signs of their infections.

▌Preparing for a Rainy Day: How Enterprises Respond to Cyber Threats

As a hacker group with a North Korean background, APT45's multi-dimensional attack strategy and continuously expanding scope of operations pose a serious threat to global enterprises, particularly in the healthcare, finance, and energy sectors. Facing this escalating cybersecurity challenge, enterprises must adopt a proactive defense strategy to race against time to enhance their security defense capabilities. As emphasized when dealing with ransomware groups, enterprises need to strengthen and improve their own weak links in a targeted manner to effectively defend against various cyber threats, including APT45.

In response to the attack methods adopted by this hacker group, the Sixun Security Metrics Validation Platform has incorporated corresponding attack simulation rules. You can search for the keyword "APT45" on the platform to obtain attack simulation validation actions related to this threat group. Through these simulated attacks, you can verify whether your security defense system can effectively respond to attacks from this hacker group. The Sixun Security Metrics Validation Platform employs an industry-exclusive method to ensure that your validation process is safe and harmless.