Changes of Cyber Hacking Attack Aspect of North Korea Cyber-Attack Groups Applying MITRE ATT&CK

Abstract

In the process of preparing cyber security and space security enhancement plans worldwide, cyber attackssuch as North Korean cyber attacker groups Thallium, Kimsuky, Geumseong 121, and Lazarushave developed into advanced levels and continue to threaten cyber security and space security. TheNorth Korean cyber attack team has been strengthening cyber attacks by using social engineeringtechniques through political and social issues for unspecified numbers of people using detailed attackstages, procedures, technologies and tools using cyber kill chain technology, starting with APTattacks in the past. In this paper, we use the enemy cyber threat analysis data to analyze the correlationbetween North Korean cyber attack groups by applying MITRE’s ATT&CK, and estimate thesource of attack origin such as open vulnerability, malicious code information, attack group cyberattack characteristics, and attack cases. Through this, we propose Aspect change in cyber hackingattacks by North Korean cyber attack groups based on ATT&CK.