Kazakhstan Arrests Man Accused of Leading Ransomware Attacks on Korean Organizations
Summary
South Korean police say a Kazakh man accused of leading a ransomware group was arrested in Almaty. The group reportedly encrypted servers at six Korean organizations, including hospitals, using weak or default credentials; outages occurred, but victims paid no ransom.
Key points
- Police say the group attacked six Korean organizations, including hospitals and apartment management offices, from 2022 to July last year.
- Investigators said the attackers guessed commonly used or default administrator credentials, gained system access and encrypted internal data.
- The attacks caused temporary server outages, but none of the Korean victims paid the ransom demanded in Bitcoin.
- South Korean police and Kazakhstan’s National Security Committee arrested the 35-year-old man in Almaty on July 1; police said they also stopped attacks in progress.
- Police plan to share ransomware decryption information gathered during the investigation with KISA.
- Police advised organizations to change default credentials, use multi-factor authentication, control access and monitor account activity.
Article Details
- Event Type
- Arrest and disruption of a ransomware operation following cooperation between South Korean and Kazakh authorities.
- Impact
- The operation encrypted servers at six South Korean companies, including hospitals and apartment management offices, causing temporary service outages. The victims did not pay the ransom. Police reported stopping attacks that were in progress and plan to share decryption information with related organizations.
MITRE ATT&CK
Countries
KazakhstanGyeonggi Southern Police worked with Kazakhstan’s NSC to identify the Kazakh IP, arrest the suspect in Almaty, and stop live attacks.KoreaA’s organization demanded Bitcoin in exchange for decryption of encrypted servers, committing crimes in the form of point organizations targeting servers in various countries besides Korea.