North Korean Hacking Group Hijacks South Korean Email Accounts, Expands Targets to Public and Officials

A North Korean hacking group named Kimsuky compromised over 500 transit servers in South Korea and internationally, seizing control of more than 1,000 South Koreans’ email accounts. The National Police Agency’s National Investigation Bureau traced Kimsuky’s activities, confirming the hijacking of 1,468 email accounts belonging to officials in foreign affairs, defense, security, and the general public. This cyberattack expanded from targeting solely diplomatic and security professionals to include civilians. Kimsuky utilized 576 servers to alter its IP address, sending phishing emails disguised as government notices, media inquiries, and research institution messages. Opening email attachments installed malicious software, allowing information leaks from the recipient’s PC. Additionally, Kimsuky fraudulently accessed cryptocurrency exchange accounts of 19 victims, attempting to steal their digital assets. They also ran a cryptocurrency mining program on 147 hacked servers, generating a modest sum of less than 1 million won without the administrators’ knowledge.

Read More : South Korea’s FSS Pioneers World’s First Virtual Asset Bureau to Combat Market Manipulation