CTG-2460
2020-09-19 • Secure Works • NICKEL ACADEMY
SecureWorks' Counter Threat Unit tracks this activity as CTG-2460, one of several designations researchers use for a broader North Korean cluster the company calls Nickel Academy, encompassing cyber operations run by North Korea's Reconnaissance General Bureau that are not attributed to specific subgroups. The activity has been observed since at least 2009, initially concentrated on South Korean government and commercial targets, and gained wider notoriety for the November 2014 attack on Sony Pictures. While South Korea remains a primary focus, targeting has expanded globally to government agencies, think tanks, financial institutions, transportation and utility companies, non-governmental organizations, cryptocurrency exchanges, and defense contractors. Operators rely on customized malware delivered mainly through spearphishing, along with malicious software disguised as legitimate applications, sometimes signed with stolen certificates, and distributed denial-of-service operations. Tooling is routinely reworked, producing new malware variants or families that reuse components from earlier tools, and the group has also carried out isolated destructive attacks alongside ongoing espionage and financial operations.
-
61
Related Actors
-
1
Related Reports
Related Actors
Related Reports
Top Authors
View all reports in this cluster