Rim Jong Hyok (림종혁)
Global | Leste Asiático e Pacífico
Sobre
Rewards for Justice is offering a reward of up to $10 million for information leading to the identification or location of any person who, while acting at the direction or under the control of a foreign government, participates in malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act.
Rim Jong Hyok (림종혁) is a national of the Democratic People’s Republic of Korea (DPRK) and is associated with the malicious cyber group known as Andariel. The Andariel group is controlled by the DPRK’s military intelligence agency, the Reconnaissance General Bureau, which has primary responsibility for the DPRK’s malicious cyber activities and which also is involved in the DPRK’s illicit arms trade.
Andariel’s main targets include foreign businesses, government entities, and the defense industry. Rim and others conspired to hack into the computer system of U.S. hospitals and other healthcare providers, install Maui ransomware, and extort a ransom. The ransomware attacks encrypted victims’ computers and servers used for medical testing or electronic medical records and disrupted healthcare services. These malicious cyber actors then used the ransom payments to fund malicious cyber operations targeting U.S. government entities and U.S. and foreign defense contractors, among others. In one cyber espionage operation that began in November 2022, the malicious cyber actors hacked a U.S.-based defense contractor from which they extracted more than 30 gigabytes of data, including technical information regarding materials used in defense aviation assets.
U.S. law enforcement investigators have documented that Andariel actors victimized five healthcare providers, four U.S.-based defense contractors, two U.S. Air Force bases and the National Aeronautics and Space Administration.
Anyone with information on Rim Jong Hyok, the Andariel group and its activities, or associated individuals and entities should contact Rewards for Justice via the Tor-based tips-reporting channel at: he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion (Tor browser required).
