Russia and North Korea, while recognized as allies in official documents, might not share the same bond in practice. Evidence suggests that two cyber threat groups with ties to North Korea have targeted a significant Russian missile design enterprise.
SentinelOne’s cybersecurity specialists identified these two factions – StarCruft and Lazarus Group, zeroing in on NPO Mashinostroyenia. The former successfully breached “vital internal IT networks,” gaining access to an email server.
Conversely, Lazarus utilized a Windows vulnerability dubbed OpenCarrot. StarCruft operates under the guidance of the Ministry of State Security. In contrast, Lazarus is aligned with the Reconnaissance General Bureau (RGB), North Korea’s premier foreign intelligence unit.
The OpenCarrot malware, as detailed by the experts, is an adaptable malicious tool capable of “total system compromise.” It possesses an arsenal of 25 varied commands, permitting its operators to monitor victims, modify file systems, and maintain diverse communication channels. “OpenCarrot not only offers a complete takeover of the infected devices but also facilitates the orchestration of multiple breaches within a network,” noted security analysts Tom Hegel and Aleksandar Milenkoski.
In retrospect, North Korea’s selection of this particular target aligns with its ongoing investment in its debated missile agenda. This initiative has led to numerous international sanctions. Conversely, NPO Mashinostroyeniya, headquartered in Reutov, is a missile design agency, as reported by several news outlets. It faced sanctions from the U.S. Department of Treasury in 2014 due to “Russia’s persistent endeavors to unsettle eastern Ukraine and its continued control over Crimea.”
This incident stands out as one of the few documented instances where allied nations resort to cyber warfare against each other to further their strategic ambitions. Time magazine has depicted North Korea as being unwaveringly focused on enhancing its nuclear and missile prowess for over six decades.