Hyundai Merchant Marine (HMM)

Hyundai Merchant Marine (HMM) was targeted in a prolonged cyber-espionage campaign from **April 2010 to 2013** by North Korean attackers using the **Icefog (Fucobha) backdoor**. The attack, part of the **Kimsuky APT group**, relied on **spear-phishing and exploits of known vulnerabilities** to infiltrate the company’s systems. The attackers maintained persistent access for **months to years**, continuously exfiltrating sensitive data, including **documents, email credentials, and network access passwords**. The campaign focused on **data theft**, compromising the **supply chain** and targeting entities like **government institutions, military contractors, maritime/shipbuilding groups, telecom operators, satellite operators, and high-tech firms**. HMM, a key player in global shipping, faced **long-term intelligence extraction**, risking **operational secrets, proprietary maritime data, and potential disruptions to logistics networks**. The attack’s stealthy nature allowed sustained espionage, posing **strategic risks to corporate and national security** while undermining trust in critical infrastructure.

Source: https://www.theregister.com/2013/09/26/icefog_hit_and_run_apt_japan_south_korea/

TPRM report: https://www.rankiteo.com/company/hmmofficial

"id": "hmm702092025",
"linkid": "hmmofficial",
"type": "Cyber Attack",
"date": "4/2010",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"

{'affected_entities': [{'industry': ['maritime', 'shipbuilding', 'logistics'],
                        'location': 'South Korea',
                        'name': 'Hyundai Merchant Marine',
                        'type': 'company'}],
 'attack_vector': ['spear-phishing', 'exploitation of known vulnerabilities'],
 'data_breach': {'data_exfiltration': True,
                 'sensitivity_of_data': 'high (espionage-targeted, internal '
                                        'network access)',
                 'type_of_data_compromised': ['documents',
                                              'email credentials',
                                              'network access passwords']},
 'description': 'Hyundai Merchant Marine was targeted by North Korean '
                "attackers (APT group 'Icefog' or 'Fucobha') in a prolonged "
                'cyber-espionage campaign from April 2010 to 2013. The attack '
                'relied on spear-phishing and exploits for known '
                "vulnerabilities to deploy the 'Icefog' backdoor. The "
                "campaign, named 'Kimsuky,' focused on data theft, including "
                'documents, email credentials, and network access passwords. '
                'Victims remained infected for months or years, with '
                'continuous data exfiltration. The operation targeted supply '
                'chains, government institutions, military contractors, '
                'maritime/shipbuilding groups, telecom/satellite operators, '
                'industrial/high-tech companies, and mass media.',
 'impact': {'data_compromised': ['documents',
                                 'email account credentials',
                                 'network access passwords']},
 'initial_access_broker': {'backdoors_established': ['Icefog/Fucobha backdoor'],
                           'entry_point': ['spear-phishing',
                                           'exploited vulnerabilities'],
                           'high_value_targets': ['government institutions',
                                                  'military contractors',
                                                  'maritime/shipbuilding '
                                                  'groups',
                                                  'telecom operators',
                                                  'satellite operators',
                                                  'industrial/high-tech '
                                                  'companies',
                                                  'mass media'],
                           'reconnaissance_period': 'prolonged (months to '
                                                    'years)'},
 'motivation': 'data theft (documents, email credentials, network access '
               'passwords) for espionage purposes',
 'post_incident_analysis': {'root_causes': ['spear-phishing success',
                                            'unpatched vulnerabilities',
                                            'persistent backdoor '
                                            '(Icefog/Fucobha)']},
 'threat_actor': ['Icefog', 'Fucobha', 'Kimsuky (North Korean APT group)'],
 'title': 'Hyundai Merchant Marine Cyber-Espionage Campaign (Kimsuky) via '
          'Fucobha/Icefog Backdoor (2010–2013)',
 'type': ['cyber-espionage',
          'APT (Advanced Persistent Threat)',
          'supply chain attack']}