North Korean hackers breached top Russian missile maker

Details

Written by northsouth

Category: Asia

Published: 07 August 2023

Hits: 802

By James Pearson and Christopher Bing

LONDON/WASHINGTON - An elite group of North Korean hackers secretly breached computer networks at a major Russian missile developer for at least five months last year, according to technical evidence reviewed by Reuters and analysis by security researchers.

Reuters found cyber-espionage teams linked to the North Korean government, which security researchers call ScarCruft and Lazarus, secretly installed stealthy digital backdoors into systems at NPO Mashinostroyeniya, a rocket design bureau based in Reutov, a small town on the outskirts of Moscow.

Reuters could not determine whether any data was taken during the intrusion or what information may have been viewed. In the months following the digital break-in Pyongyang announced several developments in its banned ballistic missile programme but it is not clear if this was related to the breach.

Experts say the incident shows how the isolated country will even target its allies, such as Russia, in a bid to acquire critical technologies.

NPO Mashinostroyeniya did not respond to requests from Reuters for comment. Russia's embassy in Washington did not respond to an emailed request for comment. North Korea's mission to the United Nations in New York did not respond to a request for comment.

News of the hack comes shortly after a trip to Pyongyang last month by Russian defence minister Sergei Shoigu for the 70th anniversary of the Korean War; the first visit by a Russian defence minister to North Korea since the 1991 breakup of the Soviet Union.

The targeted company, commonly known as NPO Mash, has acted as a pioneer developer of hypersonic missiles, satellite technologies and newer generation ballistic armaments, according to missile experts – three areas of keen interest to North Korea since it embarked on its mission to create an Intercontinental Ballistic Missile (ICBM) capable of striking the mainland United States.

According to technical data, the intrusion roughly began in late 2021 and continued until May 2022 when, according to internal communications at the company reviewed by Reuters, IT engineers detected the hackers' activity.

NPO Mash grew to prominence during the Cold War as a premier satellite maker for Russia's space programme and as a provider of cruise missiles.

EMAIL HACK

The hackers dug into the company's IT environment, giving them the ability to read email traffic, jump between networks, and extract data, according to Tom Hegel, a security researcher with U.S. cybersecurity firm SentinelOne, who initially discovered the compromise.

"These findings provide rare insight into the clandestine cyber operations that traditionally remain concealed from public scrutiny or are simply never caught by such victims," Hegel said.

Hegel's team of security analysts at SentinelOne learned of the hack after discovering that an NPO Mash IT staffer accidentally leaked his company's internal communications while attempting to investigate the North Korean attack by uploading evidence to a private portal used by cybersecurity researchers worldwide.

When contacted by Reuters, that IT staffer declined to comment.

The lapse provided Reuters and SentinelOne with a unique snapshot into a company of critical importance to the Russian state which was sanctioned by the Obama administration following the invasion of Crimea.

Two independent computer security experts, Nicholas Weaver and Matt Tait, reviewed the exposed email content and confirmed its authenticity. The analysts verified the connection by checking the email's cryptographic signatures against a set of keys controlled by NPO Mash.

"I'm highly confident the data's authentic," Weaver told Reuters. "How the information was exposed was an absolutely hilarious screwup".

SentinelOne said they were confident North Korea was behind the hack because the cyber spies re-used previously known malware and malicious infrastructure set up to carry out other intrusions.

'MOVIE STUFF'

In 2019, Russian President Vladimir Putin touted NPO Mash's "Zircon" hypersonic missile as a "promising new product", capable of travelling at around nine times the speed of sound.

The fact North Korean hackers may have obtained information about the Zircon does not mean they would immediately have that same capability, said Markus Schiller, a Europe-based missile expert who has researched foreign aid to North Korea's missile programme.

"That's movie stuff," he said. "Getting plans won't help you much in building these things, there is a lot more to it than some drawings".

However, given NPO Mash's position as a top Russian missile designer and producer, the company would be a valuable target, Schiller added.

"There is much to learn from them," he said.

Another area of interest could be in the manufacturing process used by NPO Mash surrounding fuel, experts said. Last month, North Korea test-launched the Hwasong-18, the first of its ICBMs to use solid propellants.

That fuelling method can allow for faster deployment of missiles during war, because it does not require fuelling on a launchpad, making the missiles harder to track and destroy before blast-off.

NPO Mash produces an ICBM dubbed the SS-19 which is fuelled in the factory and sealed shut, a process known as "ampulisation" that yields a similar strategic result.

"It's hard to do because rocket propellant, especially the oxidiser, is very corrosive," said Jeffrey Lewis, a missile researcher at the James Martin Center for Nonproliferation Studies.

"North Korea announced that it was doing the same thing in late 2021. If NPO Mash had one useful thing for them, that would be top of my list," he added.

Pakistan: Up to 30 dead and over 80 injured following train crash

Details

Written by northsouth

Category: Asia

Published: 06 August 2023

Hits: 897

ISLAMABAD - At least 30 people have died following a train crash in southern Pakistan, reports have stated.

According to local broadcaster, Geo, a further 80 people have been injured after the train derailed near Nawabshah in the southern province of Sindh, roughly 275 km (171 miles) from the country’s largest city Karachi.

It is thought 10 carriages of the Hazara Express derailed as it travelled from Karachi to Rawalpindi.

The country’s railway minister, Khawaja Saad Rafique, said: “Ambulances are rushing towards the scene.

“An emergency has been declared at the Nawab Shah and Sukkur hospitals.”

Senior railway officer Mahmoodur Rehman Lakho said rescue crews took injured passengers to the nearby Peoples Hospital in Nawabshah.

Mohsin Sayal, another senior railway officer, said train traffic has been suspended on the main railway line as repair trains have been dispatched to the scene.

He added that alternative travel arrangements and medical care will be made available for the train's passengers.

Train crashes often occurred on poorly maintained railways tracks in Pakistan where colonial-era communications and signal systems haven't been modernized and safety standards are poor.

Imran Khan jailed for three years and banned from politics for five years

Details

Written by northsouth

Category: Asia

Published: 05 August 2023

Hits: 824

ISLAMABAD - A trial court in Pakistan has sentenced former prime minister Imran Khan to jail for three years on charges of illegally selling state gifts, stating that the accusations against the prominent leader were proven.

Khan was arrested immediately after the court sentence in the eastern city of Lahore on Saturday by the Pakistan police.

The Islamabad trial court has also disqualified him from politics for five years, imposing a ban on his political activities.

The opposition leader has also been fined 100,000 Pakistani rupees (£278) by the trial court, which was directed to hear the case on the orders of the Pakistan High Court.

Khan’s residence in Lahore was surrounded by the police after the verdict was announced, reported local media and witnesses.

Khan, the leading opposition face in Pakistan and the chief of the major national party, Pakistan Tehreek-e-Insaf, is facing more than 150 cases in the country as he continues to target the military and the current administration.

The cricketer-turned-politician has been accused of misusing his prime ministerial tenure to buy and sell gifts in state possession that his office received during foreign visits from 2018 to 2022.

The gifts, worth more than 140m Pakistani rupees (£390,357), included watches given by a royal family, according to government officials who have alleged that Khan’s aides sold the assets in Dubai.

His party, PTI, have already filed an appeal in the country’s Supreme Court over the district court order, a statement by PTI officials read.

Condemning the court’s order, his party shared a video of Khan asking the “alive” nation to “not accept slavery” and said that Khan did not resist arrest attempts.

“The decision of the Kangaroo Court of Dilawar [additional district and sessions judge Humayun Dilawar] was not yet received by anyone in the court, but the Lahore Police was already there to kidnap the chairman Tehreek-e-Insaf. Chairman Imran Khan did not resist. Every process from the beginning of the case to the trial and from the trial to the abduction is illegal,” it said in a statement on its official social media account.

On Friday, the trial over the “Toshakhana case” was halted on the directions of the High Court which asked the lower court to check whether a legal complaint filed by Pakistan’s election commission, as part of an enquiry against Khan, constituted a criminal proceeding, his lawyer Naeem Panjhuta said.

The first inquiry into the case was conducted by the country’s election commission, which found the 70-year-old politician guilty of unlawfully selling state gifts.

According to Khan’s legal team, after his arrest from Lahore he was flown to Islamabad via helicopter to begin serving his sentence.

Legal experts have said a guilty verdict can exclude Khan from national elections that are due to be held by November and severely impact his political career as he looks to make a comeback in the top role.