Rgb

RGB is a threat actor group associated with North Korea's Reconnaissance General Bureau (RGB), which has been involved in numerous cyber espionage activities. The RGB 3rd Bureau, based in Pyongyang and Sinuiju, includes state-sponsored cyber groups known as Andariel, Onyx Sleet (formerly PLUTONIUM), DarkSeoul, Silent Chollima, and Stonefly/Clasiopa. These actors have been implicated in various malicious activities, including the use of custom malware, such as 'Maui', to encrypt and extort ransom payments from U.S. healthcare entities. The indictment alleges that Rim, an operative working for the RGB, participated in these operations, using the laundered proceeds from the ransomware attacks to fund further espionage activities. The RGB's activities extend beyond traditional RGB systems, incorporating RGB-D and RGB-Infrared (IR) cross-modality person re-identification (re-ID). Despite expectations that RGB-D systems would be more robust against adversarial examples, they have proven to be highly vulnerable, especially to adversarial patch attacks. Furthermore, the RGB's techniques include pixel-hiding and other steganographic methods, posing a danger when hidden data is read by a program capable of extracting and executing the malicious code. In response to RGB's activities, the U.S. Federal Bureau of Investigation (FBI) and other authoring partners have released a cybersecurity advisory. Recommended defensive measures include monitoring for suspicious command-line activity, implementing multi-factor authentication for remote access services, and properly segmenting and using allow-listing tools for critical assets. Despite these efforts, the RGB continues to pose a significant threat, with recent claims by the Russian-speaking hacktivist group RGB-TEAM of breaching Russia’s prosecutor general’s website and leaking criminal records. Entities associated with certain industries should remain vigilant in defending their networks from these ongoing cyber threats.