North Korean Hackers Target U.S. Hospitals to Fund Espionage Campaign

Thursday disclosed by federal authorities that ransomware has been used by North Korean hackers to target many U.S. hospitals and healthcare systems. Allegedly, the illicit operation was meant to support a covert campaign aimed at obtaining confidential data from American military and scientific establishments.

Starting in May 2021, the worldwide hacking effort was spearheaded by a gang connected to North Korea’s Reconnaissance General Bureau (RGB) attacking a Kansas hospital. Along with electronic document servers, the ransomware turned off X-ray and diagnostic devices. Along with a South Korean manufacturing company, similar attacks targeted locations in Arkansas, Connecticut, Florida, and Colorado.

The sole named conspiratorial defendant is North Korea Johg Kyok. Prosecutors assert Kyok and his gang, Andariel, kept the systems of the hospital under control until a Bitcoin ransom was paid, returning decryption keys.

The State Department has promised a $10 million prize for information revealing Kyok or other gang members’ whereabouts. Online accounts connected to the assaults have been taken by the FBI, who also retrieved virtual money valued more than $600,000 to be reimbursed to victims.

This state-sponsored outfit targets defense, aerospace, nuclear, and engineering sectors to access confidential technical data, according to cybersecurity advice. Among others, the hackers supposedly got access to NASA’s networks, Randolph Air Force Base, and a Massachusetts defense contractor.

With warnings provided by the UK’s National Cyber Security Centre regarding continuous worldwide threats, their activities also included Taiwan and South Korea.