Sector A03
2020-03-12 • NSHC • HACKING ACTIVITY OF SECTORA GROUP IN 2019
SectorA03 is a North Korean activity cluster within NSHC Security’s SectorA threat-actor taxonomy. In September 2024, NSHC observed the group operating against targets in Hong Kong and Germany. Its attack chain used a malicious DLL whose strings were protected with XOR and Base64 encoding. The DLL abused ImageView_Fullscreen, an exported function in the legitimate Windows Photo Viewer component shimgvw.dll, to support execution. The final-stage malware collected information about compromised systems and, depending on operational requirements, could receive and execute additional payloads from attacker-controlled infrastructure. NSHC places SectorA03 within a broader North Korean ecosystem whose persistent strategic objectives include collecting political and diplomatic intelligence related to South Korean government activity while also conducting globally distributed operations that can support acquisition of financial resources.
-
16
Related Actors
-
9
Related Reports
Related Actors
Related Reports
Top Authors
View all reports in this cluster