Rgb

RGB is a threat actor group, part of North Korea's Reconnaissance General Bureau (RGB), a military intelligence agency under the General Staff Bureau of the Korean People's Army. Over the years, the RGB has revealed at least six threat groups, including Andariel, also known as Onyx Sleet, formerly PLUTONIUM, DarkSeoul, Silent Chollima, and Stonefly/Clasiopa. These groups are reportedly responsible for various malicious activities, including ransomware operations against U.S. healthcare entities to fund their espionage activity. A significant example includes the use of custom malware known as 'Maui', used to encrypt victim’s computer networks and extort organizations for ransom payments in cryptocurrency. The RGB 3rd Bureau actors have been accused of targeting and hacking computer networks of U.S. hospitals and other healthcare providers. Their method involves encrypting electronic files, extorting a ransom payment, laundering those payments, and using the laundered proceeds to hack targets of interest to the North Korean regime. These threat actors have shown a poor grasp of the English language, with common errors such as “Microsoft Cooperation” instead of “Microsoft Corporation” found across numerous RGB 3rd Bureau malware samples. Despite RGB-D systems' expected robustness against adversarial examples, they have proven to be highly vulnerable. This vulnerability extends to RGB-Infrared (IR) cross-modality person re-identification (re-ID), which searches an IR image in an RGB gallery or vice versa. To protect against malicious activity by RGB 3rd Bureau’s Andariel group and other cyber threat actors, it is recommended that entities monitor suspicious command-line activity, implement multi-factor authentication for remote access services, and properly segment and use allow-listing tools for critical assets. Particularly, entities involved in or associated with industries and fields targeted by North Korea state-sponsored cyber operations should remain vigilant in defending their networks.