U.S. Indicts North Korean in Ransomware Attacks and Theft of Military Data

Funds from the ransomware attacks on hospitals subsidized military espionage activities, prosecutors say.

Listen to this article · 4:55 min Learn more

Share full article

Federal prosecutors announced that they had indicted a North Korean national in a conspiracy to hack hospitals, military bases and NASA.

A federal grand jury on Thursday indicted a North Korean man on charges of stealing huge amounts of data from the computers of American military bases and defense contractors, as well as NASA and several Asian companies, in the latest sign of North Korea’s malicious cybercrime and espionage abilities.

Federal prosecutors accused the man, Rim Jong Hyok, of working with unnamed co-conspirators to steal data in 2022 from four unnamed American defense contractors and from Randolph Air Force Base in Texas and Robins Air Force Base in Georgia. The indictment also said that the North Koreans had extracted data from computers in NASA’s inspector general office over three months that year.

In what experts called standard practice for North Korea’s cyberoperatives, Mr. Rim and his collaborators subsidized their espionage with money procured in ransomware attacks on American hospitals and health care companies, the indictment said.

The North Koreans extracted technical data from the defense contractors, including information related to uranium processing as well as military aircraft, shipbuilding and satellites, the indictment said. The hackers also infiltrated the computer systems of defense companies in South Korea, Taiwan and even an energy company in China, which has friendly relations with North Korea.

The data stolen from the South Korean and Taiwanese companies, the indictment said, included “technical and design information about military weapons and vehicles, such as tanks, fighter jets, rockets and torpedoes.”

The indictment was released on the same day that the National Security Agency, the Federal Bureau of Investigation and other U.S. and foreign agencies jointly released a public advisory warning that North Korea’s main intelligence service is conducting cyberoperations to assist the country’s military and nuclear programs.

We are having trouble retrieving the article content.

Please enable JavaScript in your browser settings.

Thank you for your patience while we verify access. If you are in Reader mode please exit and log into your Times account, or subscribe for all of The Times.