Storm-0530__2023__CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF.pdf

A joint Cybersecurity Advisory describes DPRK state-sponsored ransomware activity targeting U.S. healthcare/public health and critical infrastructure sectors, detailing observed tactics from initial access through data exfiltration, listing associated IOCs and CVEs (including CVE-2021-44228, CVE-2021-20038, CVE-2022-24990), and offering MITRE ATT&CK mappings and CP G-aligned mitigations such as backup hygiene, patch management, RDP hardening, phishing-resistant MFA, incident response planning, and reporting guidance.