Publicly disclosed information for this event

Summary

References

1. https://www.maritime-executive.com/article/north-korean-hackers-steal-warship-plans-from-dsme
2. https://www.reuters.com/article/us-northkorea-missiles-cybercrime-idUSKBN1D00EX
3. https://www.newsweek.com/north-koreas-cyber-attack-hacked-south-koreas-warship-plans-seoul-lawmaker-696956
4. https://webcache.googleusercontent.com/search?q=cache:gFbjXuLu5UIJ:https://nationalcybersecuritynews.today/south-korea-probes-possible-hack-of-dsme-computers-cybersecurity-cyberattack/
5. https://www.scmp.com/news/asia/east-asia/article/2117721/north-korea-hacked-blueprints-south-korean-warships-and-subs
6. https://therecord.media/north-korean-hackers-breach-south-korean-submarine-builder-again/

• Map, understand, patch and secure your exposed assets on the Internet.
• Implement email filtering systems to detect and block phishing emails.
• Train your organisation, personnel regularly against these threats.
• Install efficient Endpoint Detection and Response (EDR) tools.
• Work with your CSIRT organization to better understand the Tactics, Techniques and Procedures used by threat actors.
• Monitor your IT and OT systems to quickly detect potential pre-ransomware activity.
• Implement an efficient offline backup policy.
• Encrypt all sensitive data to avoid further data leaks.