Reconnaissance General Bureau Rgb

The Reconnaissance General Bureau (RGB) is a key threat actor group associated with North Korea's cyber espionage activities. Known within the global cybersecurity industry as the umbrella organization for hacking groups like "Lazarus Group," "Bluenoroff," and "Andariel," it operates under the Korean People's Army. The RGB 3rd Bureau, based in Pyongyang and Sinuiju, includes state-sponsored cyber groups such as Andariel, Onyx Sleet (formerly PLUTONIUM), DarkSeoul, Silent Chollima, and Stonefly/Clasiopa. The U.S. Federal Bureau of Investigation (FBI) has released advisories highlighting the cyber espionage activity associated with the RGB, identifying its actions as aligning with North Korea's primary foreign intelligence agency. Several individuals and entities have been implicated in connection with the RGB. For instance, Pyongyang University of Automation, one of North Korea’s premier cybersecurity instruction institutions, was sanctioned by the US for training malicious cybersecurity actors who often end up working in cybersecurity units subordinate to the RGB. Furthermore, an indictment filed in the U.S. District Court in Los Angeles alleges that Jon Chang Hyok, Kim Il, and Park Jin Hyok were members of units of the RGB, engaging in criminal hacking activities. Another individual, Rim, was alleged to have worked for the RGB, participating in the conspiracy to target and hack computer networks of U.S. hospitals and other healthcare providers. Kimsuky, also known as APT43, ARCHIPELAGO, Black Banshee, Emerald Sleet (previously Thallium), Nickel Kimball, and Velvet Chollima, is another active element operating under the RGB since 2012. Researchers from Google-owned cybersecurity firm Mandiant noted that APT43's collection priorities align with the mission of the RGB, suggesting that their campaigns are likely centered around enabling North Korea’s weapons program, collecting information about international negotiations, sanctions policy, and other countries' foreign relations and domestic politics. Despite not using zero-day exploits like other state-sponsored APTs, the group has been adept at social engineering and credential harvesting in support of highly targeted phishing campaigns.