You're listening to the CyberWire Network, powered by N2K.

This is a CISA Cybersecurity Alert.

ID number Alpha Alpha 23 tag 040 Alpha.

Original release date, February, February 9, 2023.

CISA, NSA, FBI, the U.S. Department of Health and Human Services,

the Republic of Korea National Intelligence Service

and the Republic of Korea Defense Security Agency

are issuing this alert to highlight ongoing ransomware activity against

health care and public health sector organizations and other critical infrastructure sector entities.

This advisory highlights TTPs and IOCs that DPRK cyber actors use to gain access to and conduct ransomware attacks

against health care and public health sector organizations and other

critical infrastructure sector entities as well as DPRK cyber actors's use of

cryptocurrency to demand ransoms.

This alert is supplementary to previous reports on malicious cyber activities involving

DPRK ransomware campaigns, including Maui and Holy Ghost Ransomware.

The authoring agencies are issuing this advisory to highlight new observed TTPs that DPRK's cyber actors use to conduct ransomware attacks. The authoring agencies assess that revenue

from these operations supports DPRK national level priorities and objectives, including

cyber operations targeting the United States and South Korea governments.

The alert documentation linked in the show notes includes additional technical details,

IOCs, malicious actor TTPs, recovery guidance, mitigations, and response recommendations.

The FBI is seeking any information that can be shared to include boundary logs showing communication to and from foreign IP addresses,

Bitcoin wallet information, the decryptor file, and benign samples of encrypted files.

...