For the third time in less than a month, the United States Department of Justice (DOJ) announced a major enforcement action against an international cybercriminal organization that infiltrated public and private computer networks, fundamentally compromised these systems, and sought to obtain over a billion dollars from this illicit access. This past week’s indictment, which was obtained by the United States Attorney’s Office for the Central District of California, is particularly notable in that it: (1) shines a spotlight on the operations of a decade-long effort by a North Korean state sponsored cybercriminal organization to inflict monetary and reputational harm on targeted government agencies and contractors, financial institutions, cryptocurrency platforms, online casinos and entertainment industry companies; and (2) and highlights the broad array of methods utilized by this organization to evade network cybersecurity protections, exploit computer networks, and steal intellectual property and corporate secrets, while also conducting cyber-extortions, ransomware attacks, and cyber-enabled heists of bank-held funds, ATMs, and cryptocurrency. The threat posed by this organization is sufficiently acute that the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Treasury (Treasury) simultaneously released a joint advisory addressing one of the organization’s most invasive tools, the Applejeus malware, that has been used to conduct large-scale cyber-intrusions, including in this case.

This past week the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Treasury (Treasury) released a joint advisory report on HIDDEN COBRA—the cyber threat to cryptocurrency posed by North Korea—and provided mitigation recommendations for addressing this ongoing threat. This report was issued in conjunction with the unsealing of a wide-ranging indictment by the United States Attorney’s Office for the Central District of California that charged three North Korean hackers for their participation in a broad criminal conspiracy to conduct destructive cyberattacks that targeted the financial and entertainment industries, government contractors, and government agencies, including the U.S. Departments of State and Defense.