Reconnaissance General Bureau

The Reconnaissance General Bureau (RGB) is a North Korean intelligence agency known for its clandestine operations abroad. Its cyber activities, believed to be coordinated by the secretive organization, have been linked to various threat actors since at least 2014. Notable entities include the BeagleBoyz and Jumpy Pisces, which are state-sponsored threat groups associated with the RGB. The RGB's activities have evolved over time, shifting from espionage to targeting private companies, particularly those with limited intelligence value. This shift was observed by Symantec researchers in August and has been attributed to groups linked to the RGB, such as StoneFly. Several advanced persistent threat (APT) groups associated with the RGB have been active since 2018, including financially motivated entities that weaponize fake crypto platforms for attacks. Among these groups is Citrine Sleet, also known as AppleJeus, Labyrinth Chollima, UNC4736, and Hidden Cobra. This group, tracked within Bureau 121 of North Korea's RGB, was revealed by Microsoft in an August 30 blog post to have used CVE-2024-7971 in a campaign targeting crypto companies for financial gain. Other significant APT groups linked to the RGB include Kimsuky and Andariel, both of which have been involved in major hacking activities. The RGB's activities extend beyond cyberattacks and into illicit arms trade and ransomware incidents. For instance, an individual named Rim, who worked for the RGB, was indicted for participating in a conspiracy to target and hack computer networks of U.S. hospitals and other healthcare providers. The aim was to encrypt their electronic files, extort a ransom payment, launder those payments, and use the laundered proceeds to hack targets of interest to the North Korean regime. Court documents reveal that Rim and his co-conspirators, known in the private sector as 'Andariel,' 'Onyx Sleet,' and 'APT45,' laundered ransom payments through China-based facilitators. These funds were then used to purchase internet infrastructure for further hacking and exfiltration of sensitive defense and technology information from global entities.