RGB

• Green Pine Associated Corporation (KPe.010)

• Moranbong University

• 110 Research Institute (110 호 연구소)

  Below cyber actors are often referred to as “Lazarus Group”

  • Temp.Hermit

    • Sony Pictures hack (2014), Bangladesh Bank heist ($81M, 2016), WannaCry outbreak (2017)

  • Citrine Sleet (aka: AppleJeus, Gleaming Pisces)

    • Malware embedding ‘Jeus’ was distributed via the fake app Celas Trade Pro.

  • TraderTraitor (aka: Jade Sleet, UNC4899)

    • Crypto-theft cybercrime units

  • CryptoCore (aka: Sapphire Sleet, Alluring Pisces)

    • Crypto-theft cybercrime units

• 63 Research Center (63 연구소)

  • Kimsuky (aka: APT43)

    • Spear-phishing targets ROK and US officials, journalists, and policy researchers

  • TA408 (aka: Cerium)

    • Targeting global aerospace, defense, and pharma sectors, and US and ROK militaries

  • Konni (aka: TA406)

    • Targeting Russian officials since 2012, with financially motivated activity emerging in recent years

• Office 970 (970 소)

  • Andariel (aka: Onyx Sleet, Silent Chollima, and APT45)

    • DarkSeoul incident (2013): disruption of ROK media and banking networks

    • Ransomware attacks against the healthcare sector, including US hospitals

    • Targeting global defense, aerospace, nuclear, and engineering sectors for DPRK WMD programs

• 722 Liaison Office (722 연락소)

  Involved in IT freelancing and hacking activities.

  • Devices have been linked to IP ranges 175.45.178.11–175.45.178.19, with overlapping activity across 210.52.109.0–210.52.109.255.

• Chosun Expo Joint Venture Corporation (Korea Expo Joint Venture, 조선엑스포합영회사)

  • RGB front company linked to the 110 Research Institute and the 722 Liaison Office.

    • The 2014 Sony Pictures hack and the 2017 WannaCry attack

    • The May 2017 WannaCry ransomware attack infected over 300,000 computers in 150+ countries, disrupting FedEx, Nissan, Renault, and the UK’s National Health Service

•  414 Liaison Office (414 연락소)

  • Targeting ROK government entities, including the Office of the President and the Ministry of Unification, for technical reconnaissance and intelligence collection.