State-Sponsored Hackers: Lessons From a North Korean Espionage Campaign

By J. Mesa

Biba Mes CHamoru! This post looks at a cybersecurity incident that shows how malicious actors backed by a national government operate, and what the rest of us can learn from it.

What happened in this campaign?

In February 2023, security researchers reported that a North Korean hacking group had run an espionage campaign from August through November 2022. The group broke into organizations in medical research, healthcare, defense, energy, and chemical engineering, along with a leading research university.

The attackers took large volumes of data from their victims and stayed undetected for months.

Who was behind it?

Researchers at the security firm WithSecure attributed the campaign to the Lazarus Group, a hacking organization linked to the North Korean government. Lazarus has a long record. Governments and researchers have tied it to the 2014 attack on Sony Pictures, the 2016 theft from Bangladesh Bank, and the 2017 WannaCry ransomware outbreak.

What is a state-sponsored hacking group?

A state-sponsored group works for, or with the support of, a national government. Its goals differ from those of ordinary criminals:

• Espionage. Stealing research, defense information, and trade secrets
• Money. Funding the government through theft, including cryptocurrency theft
• Disruption. Preparing to damage another country’s critical services

These groups have time, funding, and patience. Security teams often call them advanced persistent threats, or APTs.

How did the attackers get in?

According to the researchers, the group entered at least one victim through an unpatched email server. A fix for the flaw existed. The victim had not installed it.

That detail matters. A well-funded government group did not need a secret technique. It used a known flaw in software that someone forgot to update.

How did they stay hidden for months?

Once inside, the attackers moved with care.

• They used legitimate administration tools already present on the network, so their activity looked normal.
• They created their own accounts and used stolen credentials.
• They moved data out in pieces over time.

It is common for attackers to remain inside a network for a long time before anyone notices. If that makes you uneasy, you have the right mindset.

Why did they target these industries?

• Medical research and healthcare. These organizations hold patient data and valuable research. Stolen health information harms the people it describes.
• Defense and energy. These hold information tied to national security. An attack on them could compromise government operations or disrupt energy supply, a serious outcome for island communities that depend on a small number of providers.
• Universities. Research institutions produce new technology with commercial and military value. Stealing it gives a sponsor an advantage it did not earn.

Would a state-sponsored group target a small business?

It can happen, for three reasons.

• You are a route to someone else. Small suppliers, contractors, and IT providers connect to larger targets.
• Scanning is automated. Attackers look for vulnerable systems across the whole internet. An unpatched server gets found regardless of who owns it.
• Tools spread. Techniques built by government groups reach criminal groups within months.

If you hold contracts with government, healthcare, or infrastructure clients, treat this as a direct risk.

How do I detect an intruder who is already inside?

• Collect logs from servers, firewalls, and cloud services, and keep them for months
• Alert on new administrator accounts, logins at odd hours, and large outbound data transfers
• Review who has administrator rights every quarter
• Run a vulnerability scan on a schedule
• Consider a managed detection service if you have no staff to watch alerts

No system is fully secure. Assume a breach is possible, and build the means to see it.

What is zero trust?

Zero trust is a security approach that assumes any user or device could be compromised. Nothing gets access because of where it sits on the network. Each request must prove who it is and that it is allowed.

In practice, zero trust means:

• Multi-factor authentication for every user
• Access limited to what each role needs
• Network segments that keep one compromised computer from reaching everything
• Continuous monitoring

A small business can start with the first two this month.

Why does employee training matter against advanced attackers?

Many attacks, including those from government groups, start with a person. Lazarus is known for fake job offers sent to employees on professional networking sites. Staff who can spot social engineering, and who report it, close that door.

Train your team to:

• Question unexpected messages, job offers, and file attachments
• Verify requests through a second channel
• Report anything suspicious right away, without fear of blame

What should my business do now?

1. Patch internet-facing systems first: email servers, VPNs, and firewalls.
2. Turn on multi-factor authentication for all accounts.
3. Review administrator accounts and remove the ones you don’t need.
4. Turn on logging and keep the logs.
5. Train your staff on social engineering.
6. Write an incident response plan and test it.

Where can I report suspected state-sponsored activity?

In the United States, report to the FBI through your local field office or at ic3.gov, and to CISA at cisa.gov/report. Both agencies share warnings that help other organizations defend themselves.

How long do attackers stay inside a network before anyone notices?

Security teams call this dwell time. Industry reports put the typical figure at days to weeks, and espionage groups often stay far longer because they work to avoid attention. In this campaign the intruders operated for months.

Long dwell time gives an attacker room to find your most valuable data and your backups. Every day you cut from it limits the damage. Logging, alerting, and regular reviews of accounts are the tools that shorten it.

What is the difference between espionage and ransomware?

Ransomware announces itself, because the attacker wants payment. Espionage stays quiet, because the attacker wants to keep access. You may never see a ransom note from a spy. The first sign is often a call from law enforcement or a security researcher, which is one more reason to keep good logs.

Your next step

This campaign is a reminder that determined attackers succeed through ordinary gaps. Review your defenses and make sure your employees know how to identify and report suspicious activity. Cerberus Cybersecurity offers risk assessments and training built for small and mid-sized organizations. Contact us to start.