Home > National > Social Affairs

CJ Group digital certificate misused in cyberattack linked to North Korea

Published: 07 May. 2025, 17:47

Low polygon wireframe Hacker behind a laptop monitor [GETTY IMAGES BANK]

A digital certificate issued to CJ OliveNetworks, the IT arm of Korea’s CJ Group, was leaked and misused in a cyberattack linked to North Korea, cybersecurity officials said Wednesday.

Investigators found that a malicious file discovered late last month carried a digital signature issued to CJ OliveNetworks, suggesting hackers had stolen and exploited the company’s certificate. Digital signatures are intended to verify the legitimacy of software and its creator.

The presence of such a file indicates that the digital certificate of CJ OliveNetworks may have been stolen and misused by a North Korean actor.

The hacking group suspected to be behind the breach is Kimsuky, a known North Korean cyberespionage unit.

RedDrip Team, a Chinese cybersecurity firm, revealed evidence on Tuesday suggesting that Kimsuky used the stolen certificate to attempt a cyberattack on the Korea Institute of Machinery and Materials, a national research institute.

“The certificate in question was issued for software development and distribution purposes,” said a representative from CJ OliveNetworks, confirming the breach. “It was revoked immediately in the morning after verification. The certificate is no longer valid.”

CJ OliveNetworks is responsible for the development and management of IT infrastructure across major CJ affiliates, including CJ Logistics and CJ ENM. The company also provides B2B solutions such as smart factory systems and logistics automation to manufacturing clients both in South Korea and overseas.

Translated from the JoongAng Ilbo using generative AI and edited by Korea JoongAng Daily staff.
BY JEONG JAE-HONG [[email protected]]