North Korean Group Partners with Play Ransomware in Major Cyber Attack
Oct 30, 2024
Ransomware / Threat Intelligence
Threat actors associated with North Korea have been linked to a recent cyber incident involving the notorious Play ransomware, highlighting their financial motives. This activity, which took place between May and September 2024, is connected to a group known as Jumpy Pisces, also referred to as Andariel, APT45, DarkSeoul, Nickel Hyatt, Onyx Sleet (previously Plutonium), Operation Troy, Silent Chollima, and Stonefly. According to a new report from Palo Alto Networks’ Unit 42, “We have moderate confidence that Jumpy Pisces, or a segment of this group, is now collaborating with the Play ransomware collective.” This incident is particularly significant as it represents the first documented partnership between the Jumpy Pisces North Korean state-sponsored group and an underground ransomware operation. Active since at least 2009, Andariel is associated with North Korea’s Reconnaissance General Bureau (RGB) and has a history of deploying various cyber tactics.
Ransomware / Threat Intelligence
Significant Cyber Attack Involves North Korean Collaboration with Play Ransomware Group October 30, 2024 In a notable development in the realm of cybersecurity, threat actors associated with North Korea have been identified as key players in a recent attack utilizing the Play ransomware variant. This collaboration highlights the increasing intersection…
North Korean Group Partners with Play Ransomware in Major Cyber Attack
Oct 30, 2024
Ransomware / Threat Intelligence
Threat actors associated with North Korea have been linked to a recent cyber incident involving the notorious Play ransomware, highlighting their financial motives. This activity, which took place between May and September 2024, is connected to a group known as Jumpy Pisces, also referred to as Andariel, APT45, DarkSeoul, Nickel Hyatt, Onyx Sleet (previously Plutonium), Operation Troy, Silent Chollima, and Stonefly. According to a new report from Palo Alto Networks’ Unit 42, “We have moderate confidence that Jumpy Pisces, or a segment of this group, is now collaborating with the Play ransomware collective.” This incident is particularly significant as it represents the first documented partnership between the Jumpy Pisces North Korean state-sponsored group and an underground ransomware operation. Active since at least 2009, Andariel is associated with North Korea’s Reconnaissance General Bureau (RGB) and has a history of deploying various cyber tactics.
