NIS: "North Korea Concentrated Hacking on Domestic Semiconductor Firms... Stole Design Blueprints"

North Korea Appears to Start Semiconductor Self-Production for Weapon Development
Recently Lost Product Design Blueprints and Facility Site Photos

North Korea has recently conducted intensive cyberattacks targeting domestic semiconductor equipment companies, stealing design blueprints and other materials.

The National Intelligence Service (NIS) announced on the 4th that it detected North Korea focusing on cyberattacks against domestic semiconductor equipment companies from the second half of last year until recently.

According to the NIS, North Korean hacking groups targeted companies whose servers were connected to the internet and exposed vulnerabilities. The companies' work servers used for managing documents and other data became the hackers' targets.

North Korea primarily employed the 'LotL (Living off the Land)' technique, minimizing the use of malware and instead utilizing legitimate programs installed on the servers to carry out attacks.

The NIS explained, "This method is hard to detect with security tools because the attacker remains inconspicuous."

In fact, in December last year, Company A and in February this year, Company B were hacked, with their configuration management server and security policy server respectively compromised, resulting in the theft of product design blueprints and photos of facility sites.

The NIS assessed that, amid difficulties in procuring semiconductors due to sanctions against North Korea and increasing semiconductor demand for weapons development such as satellites and missiles, North Korea is likely preparing for self-production of semiconductors.

Accordingly, the NIS notified the affected companies of the hacking incidents and supported the establishment of security measures. It provided threat information to major domestic semiconductor companies to prevent further damage and urged thorough self-security inspections.

An NIS official emphasized, "Security updates and access controls must be implemented for internet-exposed servers, and strict account management, including regular strengthening of administrator authentication, is essential."

This content was produced with the assistance of AI translation services.