South Korea’s state-run Korea Atomic Energy Research Institute (KAERI) on Friday disclosed that its internal network was infiltrated by suspected attackers operating out of its northern counterpart.
The intrusion is said to have taken place on May 14 through a vulnerability in an unnamed virtual private network (VPN) vendor and involved a total of 13 IP addresses, one of which — “27.102.114[.]89” — has been previously linked to a state-sponsored threat actor dubbed Kimsuky.
KAERI, established in 1959 and situated in the city of Daejeon, is a government-funded research institute that designs and develops nuclear technologies related to reactors, fuel rods, radiation fusion, and nuclear safety.
Following the intrusion, the think tank said it took steps to block the attacker’s IP addresses in question and applied necessary security patches to the vulnerable VPN solution. “Currently, the Atomic Energy Research Institute is investigating the subject of the hacking and the amount of damage,” the entity said in a statement.
The development comes following a report from SISA Journal, which disclosed the breach, alleging that the agency was attempting to cover up the hack by denying such an incident took place. KAERI attributed it to a “mistake in the response of the working-level staff.”
Active since 2012, Kimsuky (aka Velvet Chollima, Black Banshee, or Thallium) is a North Korean threat actor known for its cyberespionage campaigns targeting think tanks…
