Today’s actions identify North Korean hacking groups commonly known within the global cyber security private industry as “Lazarus Group,” “Bluenoroff,” and “Andariel” as agencies, instrumentalities, or controlled entities of the Government of North Korea pursuant to Executive Order (E.O.) 13722, based on their relationship to the Reconnaissance General Bureau (RGB). Lazarus Group, Bluenoroff, and Andariel are controlled by the U.S.- and United Nations (UN)-designated RGB, which is North Korea’s primary intelligence bureau. Lazarus Group targets institutions such as government, military, financial, manufacturing, publishing, media, entertainment, and international shipping companies, as well as critical infrastructure, using tactics such as cyber espionage, data theft, monetary heists, and destructive malware operations. Lazarus Group was involved in the destructive WannaCry 2.0 ransomware attack which the United States, Australia, Canada, New Zealand and the United Kingdom publicly attributed to North Korea in December 2017. Lazarus Group was also directly responsible for the well-known 2014 cyber-attacks of Sony Pictures Entertainment (SPE). Also designated today are two sub-groups of Lazarus Group, the first of which is referred to as Bluenoroff by many private security firms. Bluenoroff was formed by the North Korean government to earn revenue illicitly in response to increased global sanctions. According to cyber security firms, typically through phishing and backdoor intrusions, Bluenoroff conducted successful operations targeting more than 16 organizations across 11 countries, including the SWIFT messaging system, financial institutions, and cryptocurrency exchanges. In one of Bluenoroff’s most notorious cyber activities, the hacking group worked jointly with Lazarus Group to steal approximately $80 million dollars from the Central Bank of Bangladesh’s New York Federal Reserve account. By leveraging malware similar to that seen in the SPE cyber attack, Bluenoroff and Lazarus Group made over 36 large fund transfer requests using stolen SWIFT credentials in an attempt to steal a total of $851 million before a typographical error alerted personnel to prevent the additional funds from being stolen.
Executive Order 13722 of March 15, 2016 Blocking Property of the Government of North Korea and the Workers’ Party of Korea, and Prohibiting Certain Transactions With Respect to North Korea
• https://ofac.treasury.gov/faqs/topic/1556
460. Can U.S. persons do business with entities in North Korea?
No. Unless authorized pursuant to a general or specific license from OFAC and/or BIS, Executive Order (E.O.) 13722 prohibits new investment in North Korea by a U.S. person and the exportation or reexportation, from the United States, or by a U.S. person, of any goods, services, or technology to North Korea. E.O. 13810 (“Imposing Additional Sanctions with Respect to North Korea”) does not modify any of those prohibitions.
Official Information
On March 15, 2016, the President issued E.O. 13722 pursuant to, inter alia, IEEPA, the NEA, the UNPA, and the North Korea Sanctions and Policy Enhancement Act of 2016 (22 U.S.C. § 9201 et seq.) (the NKSPEA), to take additional steps to address the national emergency declared in E.O. 13466 and expanded in E.O. 13551, in light of further North Korean nuclear and ballistic missile tests. E.O. 13722 was issued to ensure implementation of certain provisions of UNSCR 2270 of March 2, 2016 and the NKSPEA; it strengthened export and other trade restrictions against North Korea; and imposed a comprehensive blocking of the Government of North Korea and the Workers’ Party of Korea.
