Experts on nuclear security policy and weapons proliferation were contacted by suspected North Korean hackers posing as Voice of America journalists, according to a threat intelligence group, which says this is part of a recent pattern of impersonating reporters from major news organizations.

The online spies were attempting to gather intelligence about the stance of international officials toward the Pyongyang government of Kim Jong Un, according to a report issued by Mandiant, an American cybersecurity firm and subsidiary of Google.

It is the latest known attempt in recent months by the cyber-espionage group known as APT43, also referred to as “Kimsuky” or “Thallium,” posing as journalists and targeting government organizations in the United States and South Korea, as well as academics and think tank analysts.

At least seven journalists from five news organizations were impersonated by someone with APT43, Mandiant Senior Analyst Gary Freas told VOA on Wednesday.

“We have seen success in gathering sensitive information related to Korean Peninsula affairs,” such as targeted individuals answering questions about Western sentiment about North Korean activity, including nuclear proliferation and missile launches, Freas said.

In one email from Oct. 14, 2022, obtained by Mandiant, the sender, impersonating a VOA reporter, posed several questions related to North Korea’s missile and nuclear weapons testing programs, including: “Would Japan increase the defense budget and a more proactive defense policy?”

The recipient was asked to “send me your answers within 5 days.”

VOA “is aware that malevolent actors have attempted to impersonate our journalists in attempts to obtain information from third parties, including on nuclear proliferation issues,” said Nigel Gibbs, a VOA spokesperson. “It is something we are mindful of, and we take extra care to verify our identity and educate sources about potential impersonators.”

Mandiant said that in recent months it had been in contact with USAGM about the suspected North Korean operation impersonating VOA reporters.

“Trust between our journalists and their sources is imperative,” USAGM Public Affairs Director Laurie Moy said. “USAGM goes to great lengths to protect the security and integrity of our network journalists’ communications tools. We employ a number of reputation management services, including identifying impersonations and fake social media accounts and ensuring that public-facing images are verified and associated with agency resources.”

Moy continued: “We also provide robust IT system security to support safety concerns for our journalists. USAGM provides encrypted equipment, ensures multifactor authentication for systems access, and routinely monitors for vulnerabilities and external threats.”

Fake emails, claiming to be from reporters of VOA’s Korean Service, have been frequently sent to academics, officials and others requesting comment. In some cases, recipients of those emails have contacted VOA’s Seoul bureau and were informed the queries were not authentic.

“Our team has been a target of various aggressive phishing attempts, including impersonation, over the past few years,” said Dong Hyuk Lee, VOA’s Korean Service chief. “A dozen reporters on my team, including me, were targeted. As far as I can remember, we notified the agency’s IT office or (USAGM) security, if needed, about every case.”

Earlier this month, Mandiant also revealed that the same hacking group distributed an attachment to an email that appeared to be from a recruiter for The New York Times.

There has been similar activity linked to Pyongyang in recent years, including a phishing scam targeting journalists in South Korea in which the sender posed as a scriptwriter for the Korean Broadcasting System seeking information about North Korea.

“State-sponsored hackers regularly target or pose as journalists,” Joseph Bodnar, a research analyst for the Alliance for Securing Democracy, told VOA. “Reporters have information and access that most people don’t have. Masquerading as a journalist can be an easy way for hackers to gain and exploit a target’s trust.”

Proofpoint, a cybersecurity firm, issued a report last year detailing efforts by state-sponsored hackers in North Korea, as well as China, Iran and Turkey, to spy on or impersonate mostly U.S.-based journalists.

“These hackers can be sloppy, sending messages with incorrect grammar or misspelled words,” Bodnar said. “Google searches could reveal that the reporter they’re posing as doesn’t exist or uses a different email address. There are basic cybersecurity practices that can help people defend against this threat.”

At the State Department on Wednesday, principal deputy spokesperson Vedant Patel said that while he couldn’t address the specific events involving the impersonation of New York Times and VOA personnel, “of course the DPRK is known for taking a number of destabilizing and malign steps. This is something we are being vigilant about.”

DPRK refers to the Democratic People’s Republic of Korea, the official name of North Korea.

North Korea “often leverages nation-state malicious cyber actors to generate revenue for the regime while evading sanctions,” the U.S. Cyber National Mission Force’s Major Katrina Cheesman told VOA. “The DPRK cyber actors do this through a range of illicit means, such as cryptocurrency theft, money-laundering, ransomware and fraudulent activities of DPRK IT workers abroad.”

The Kimsuky APT group has most likely been operating since 2012, according to the U.S. Cybersecurity and Infrastructure Security Agency. It is primarily focused on carrying out financially motivated cybercrime to support the North Korean government, according to intelligence analysts.

During the coronavirus pandemic, attention shifted to pharmaceutical and other health-related companies. Other related activities APT43 is alleged to be involved with include registering web domains meant to look like legitimate websites, including one for Cornell University, an Ivy League school. The group has also used malicious apps to steal usernames and passwords and to generate cryptocurrency.

“APT43 is exceptionally good at convincing its targets,” Freas, the Mandiant analyst, said. “We’ve seen APT43 create email addresses that look similar to news reporters, or analysts at think tanks, and simultaneously spin up fake domains that also look similar to the real news outlet they are spoofing. They’ll add these to their email signatures so even if the victim grows suspicious and visits APT43’s hosted domain, it has the look and feel of a real news site.”
…

The scope of blame for Silicon Valley Bank’s failure stretches across bank executives, Federal Reserve supervisors and other regulators, the banking system’s top cop on Wednesday told U.S. lawmakers demanding answers for the lender’s swift collapse. 

“I think that any time you have a bank failure like this, bank management clearly failed, supervisors failed and our regulatory system failed,” Michael Barr, Fed Vice Chair for Supervision, told Congress. “So we’re looking at all of that.” 

The failures of SVB, and days later, Signature Bank, set off a broader loss of investor confidence in the banking sector that pummeled stocks and stoked fears of a full-blown financial crisis.

Depositors tried to pull more than $42 billion in a single day at SVB in early March, surprising regulators and kicking off deposit flight across other regional banks. 

“That’s just an extraordinary scale and speed of a run that I had not ever seen,” Barr said. “I think all of us were caught incredibly off-guard by the massive bank run that occurred when it did.”  

Representatives from both political parties pressed Barr, Martin Gruenberg, head of the Federal Deposit Insurance Corp, and Treasury undersecretary for domestic finance Nellie Liang on why regulators did not act more forcefully, given Fed supervisors had been raising issues with the bank for months.  

“There is still much we need to understand of what you knew when and how you responded,” said Republican Patrick McHenry, chair of the committee. “The bottom line for you as the panel, there’s bipartisan frustration with many of your answers. There’s a question of accountability and appearance of lack of accountability.”  

Barr on Tuesday criticized SVB for going months without a chief risk officer and for how it modeled interest rate risk, but lawmakers said the response wasn’t aggressive enough, with Democrat Juan Vargas saying, “it seems like they blew you guys off and you didn’t do anything.”  

Reports due May 1 

Both the Fed and FDIC are expected to produce reports on the failure of Silicon Valley Bank by May 1. The Fed’s report will concentrate on supervision and regulation while the FDIC report will center around deposit insurance.  

Several lawmakers asked Barr to make available the Fed’s confidential communications on supervision.  

Barr told the House Financial Services Committee that he first became aware of stress at Silicon Valley Bank on the afternoon of March 9, but that the bank reported to supervisors that morning that deposits were stable.  

Gruenberg of the FDIC told lawmakers he also became aware of SVB’s stress that Thursday evening.  

All three testifying said that regulators had sufficient tools to deal with the crisis once it happened, but Barr said the Fed could have done better on supervision. 

SVB and Signature became the second- and third-largest bank failures in U.S. history. Investors fled to safe havens like bonds while depositors moved funds to bigger institutions and money market funds. 

Markets have calmed since Swiss regulators engineered the sale of troubled Swiss giant Credit Suisse to rival UBS, and after SVB’s assets were sold to First Citizens BancShares FCNCA.O. However, investors remain wary of more troubles lurking in the financial system. 

Some Democrats have also argued a 2018 bank deregulation law is to blame. That law, mostly backed by Republicans but also some moderate Democrats, relaxed the strictest oversight for firms holding between $100 billion and $250 billion in assets, which included SVB and Signature. 

The White House is readying plans for legislation that would reinstate those regulations on midsize banks, the Washington Post reported on Wednesday, citing two sources familiar with the matter.  
…

The U.N. General Assembly adopted a landmark resolution Wednesday that will ask the International Court of Justice to issue an advisory opinion on the obligations of states under international law to protect the rights of present and future generations from the impact of climate change.

“This resolution and the advisory opinion it seeks will have a powerful and positive impact on how we address climate change and ultimately protect the present and future generations,” said Vanuatu Prime Minister Ishmael Kalsakau, whose government spearheaded the drafting and negotiations of the resolution, with a core group of 18 countries representing most corners of the world. 

“Together we will send a loud and clear message, not only around the world but far into the future: On this very day, the peoples of the United Nations, acting through their governments, decided to leave aside differences and work together to tackle the defining challenge of our times: climate change,” Kalsakau said.

More than 130 countries joined in co-sponsoring the resolution, which was adopted by consensus. While most of the world’s top emitters of greenhouse gases, including China and the United States, were noticeably absent from the co-sponsors, they did not prevent the adoption by consensus. 

The United States, which noted the Biden administration’s ambitious climate action to meet commitments consistent with keeping global warming to within the 1.5 degrees Celsius goal, said it has “serious concerns” that an ICJ opinion could hurt rather than help collective efforts to reach climate targets.

“We believe that launching a judicial process, especially given the broad scope of the questions, will likely accentuate disagreements and not be conducive to advancing our ongoing diplomatic and other processes,” U.S. delegate Nicholas Hill told the assembly. “In light of this, the United States disagrees that this initiative is the best approach for achieving our shared goals and takes this opportunity to reaffirm our view that diplomatic efforts are the best means by which to address the climate crisis.”

Japan and Germany are among the world’s top greenhouse gas emitters, and they joined as co-sponsors. Germany was also among the 18 countries that shepherded the initiative.

“Germany hopes that this initiative will contribute to further strengthen international cooperation, which is key for achieving the Paris Agreement’s objectives,” Ambassador Antje Leendertse said of the 2015 climate accord. 

The Pacific Island nation of Vanuatu’s very existence is threatened by rising sea levels. It is currently recovering from the devastation earlier this month of two Category 4 tropical cyclones in less than five days.

Kalsakau was clear that the effort is not intended to be a contentious one, nor is it a lawsuit. The authors also do not expect the Hague-based court to create new obligations on states, only to uphold existing ones. While the ICJ is the United Nation’s principal judicial organ, its decisions are not binding but carry considerable weight and can become part of what’s known as customary law.

“We believe the clarity it will bring can greatly benefit our efforts to address the climate crisis and could further bolster global and multilateral cooperation and state conduct in addressing climate change,” the prime minister said. 

U.N. Secretary-General Antonio Guterres welcomed the action, warning time is running out for nations to act boldly to fight global warming.

“This is the critical decade for climate action,” he told the assembly. “It must happen on our watch.”

The resolution began in 2019 as the brainchild of students from Vanuatu, which is among several small island states that are suffering the effects of the climate crisis but has contributed little to causing it.

“I don’t want to show a picture to my child one day of my island. I want my child to be able to experience the same environment, the same culture I grew up in,” Cynthia Houniuhi, president of Pacific Islands Students Fighting Climate Change, told reporters in a briefing ahead of the vote.

Human Rights Watch welcomed the resolution, saying it is a powerful demonstration of effective multilateral diplomacy led by a state from the Global South on behalf of people at risk.

“The overwhelming support for Vanuatu’s resolution is a major step toward gaining clarity on the legal obligations of states most responsible for climate change,” said HRW’s Environment and Human Rights director Richard Pearshouse. “It’s also important to focus — through the lens of human rights — on the obligations to protect those communities suffering most acutely.” 
…

Vadym Horodnyi comes from a family of Ukrainian soldiers. His father died defending their hometown, Chernihiv, but Vadym remained determined to join the military. The 14-year-old ultimately got a chance to study in the United States and is now a cadet at the Marine Military Academy in Texas. Nina Vishneva has his story in this report narrated by Anna Rice.
…