Nickel Tapestry

Nickel Tapestry, a North Korean threat actor, has been historically involved in various cyber schemes. The group is known for its aggressive tactics and fraudulent campaigns, with recent activities demonstrating an evolution in their modus operandi. Technical and behavioral characteristics of these new actions align with previous fraud campaigns carried out by Nickel Tapestry, indicating a continuity in the group's operations and strategies. Recently, Secureworks reported that Nickel Tapestry has expanded its operations to include theft of intellectual property, posing a significant risk to organizations that inadvertently hire a North Korean IT worker. This expansion not only broadens the scope of their potential targets but also increases the potential for additional monetary gain through extortion. The shift in tactics marks a significant change in the group's risk profile, necessitating increased vigilance and cybersecurity measures from potential target organizations. A particularly notable departure from prior Nickel Tapestry schemes is the emergence of ransom demands. In one incident, the threat actor demanded a six-figure ransom in cryptocurrency to avoid publication of stolen documents. This move towards ransomware attacks indicates a more direct approach to monetization of their activities, further escalating the threat posed by Nickel Tapestry. Organizations are advised to enhance their cybersecurity defenses and be prepared for potential ransom demands.