Reconnaissance General Bureau

The Reconnaissance General Bureau (RGB) is a North Korean intelligence agency responsible for clandestine operations abroad and is considered a significant threat actor in the cybersecurity landscape. The RGB has been linked to various Advanced Persistent Threat (APT) groups, including the BeagleBoyz, who have likely been active since at least 2014, and others such as Kimsuky and Andariel. These groups are involved in a wide range of malicious activities, from espionage to crypto theft, often targeting private companies with limited intelligence value. North Korea's cyber activities, coordinated by the RGB, have shifted focus over time, moving from traditional espionage towards more financially motivated attacks. Several incidents attributed to the RGB highlight their evolving strategies. In March, the RGB exploited MagicLine4NX, an authentication software widely used in South Korea, for espionage purposes. Later, in August, Microsoft reported that an entity within Bureau 121 of the RGB, known as Citrine Sleet, exploited a vulnerability (CVE-2024-7971) in a campaign targeting crypto companies for financial gain. Furthermore, the RGB-linked group has been known to weaponize fake crypto platforms, demonstrating their increasing sophistication in cyberattacks. The RGB's activities also extend to illicit arms trade and ransomware attacks. An indictment alleged that a member of the RGB participated in a conspiracy to target U.S. hospitals and other healthcare providers, encrypting their electronic files and extorting them for ransom payments. These funds were then laundered through China-based facilitators and used to purchase internet infrastructure for further cyberattacks. Additionally, the RGB has been observed engaging in email phishing campaigns targeting experts for insights into US and South Korean foreign policies, indicating their continued interest in geopolitical intelligence.