Nickel Academy
2017-12-15 • Secure Works • NICKEL ACADEMY
NICKEL ACADEMY is Secureworks' internal designation for cyber operations conducted by North Korea's Reconnaissance General Bureau that are not attributed to a specific subgroup. Secureworks first disclosed the name publicly in December 2017, describing a spearphishing campaign that used a fake CFO job posting to target executives at a European cryptocurrency company, attributing the activity to the actor publicly known as Lazarus Group and noting North Korean interest in bitcoin dating to at least 2013. In a later profile, Secureworks assessed NICKEL ACADEMY has been active since at least 2009, gaining notoriety for the November 2014 attack on Sony Pictures, and primarily targeting South Korean government and commercial organizations while also striking targets globally, including think tanks, financial institutions, transportation and utility companies, NGOs, cryptocurrency exchanges, and defense contractors. Secureworks describes its objectives as disruption, espionage, and financial gain, achieved through spearphishing, malware disguised as legitimate signed applications, and periodic destructive or denial-of-service operations, with tooling that is continually revised across malware families.
-
61
Related Actors
-
3
Related Reports
Related Actors
Related Reports
Top Authors
View all reports in this cluster