On July 25, 2024, the U.S. Department of Justice announced a Kansas grand-jury indictment charging North Korean national Rim Jong Hyok with allegedly helping run a cyber campaign that attacked U.S. hospitals with Maui ransomware, laundered cryptocurrency payments and then funded espionage intrusions against NASA, U.S. Air Force bases and defense-related organizations. The FBI lists Rim as wanted and last known to be in North Korea; the case remains an allegation, not a conviction.
What Rim Jong Hyok is accused of
Prosecutors allege that Rim worked with the Reconnaissance General Bureau’s Andariel unit, a North Korean operation, in a two-part campaign:
As an Amazon Associate I earn from qualifying purchases.
- Use Maui ransomware against hospitals and other healthcare providers to disrupt operations and demand cryptocurrency.
- Launder the proceeds and use them to support further computer intrusions aimed at stealing sensitive information.
The indictment charges conspiracy to commit computer hacking and conspiracy to commit promotion money laundering. The FBI’s wanted notice says a federal arrest warrant was issued on July 24, 2024.
Has Rim Jong Hyok been arrested?
The FBI notice identifies Rim as wanted and says his last known location was North Korea. The government announcements supplied for this case do not report an arrest.
#1 Best Overall
What is the legal status?
The Justice Department expressly cautions that an indictment is only an allegation and that every defendant is presumed innocent unless proven guilty beyond a reasonable doubt. No court finding of guilt is established by the announcement.
How the alleged operation connected ransomware to espionage
Stage 1: Disrupt healthcare and collect ransom
According to the DOJ, Andariel operators deployed Maui ransomware against U.S. hospitals and healthcare companies. The department says the attacks prevented providers from delivering full and timely care while the attackers sought cryptocurrency payments.
Stage 2: Move the money and attack new targets
Investigators allege that ransom proceeds were routed through Hong Kong-based facilitators. In at least one transaction, cryptocurrency was converted into Chinese yuan and accessed near the Sino-Korean Friendship Bridge. The alleged laundering enabled the group to turn ransomware revenue into funding for additional intrusions and intelligence collection.
Recommended Free Tools
| Phase | Primary targets | Alleged objective | Result described by DOJ |
|---|---|---|---|
| Ransomware | U.S. hospitals and healthcare providers | Disrupt care and extort cryptocurrency | Providers could not deliver full and timely care |
| Laundering | Cryptocurrency payment channels | Conceal and convert ransom proceeds | Funds moved through Hong Kong facilitators; one case involved yuan near the Sino-Korean Friendship Bridge |
| Follow-on intrusions | Government, military, defense and industrial organizations | Espionage and theft of technical information | Prosecutors allege theft of terabytes of data |
Which organizations were allegedly targeted?
The DOJ names the following categories of alleged victims. It does not publish a complete hospital list in the materials announcing the indictment.
| Organization or sector | Information in the government announcement |
|---|---|
| Healthcare providers | Attacked with Maui ransomware; care delivery was allegedly disrupted. |
| NASA | NASA’s Office of Inspector General is named as an alleged follow-on victim. |
| U.S. military | Two U.S. Air Force bases are listed among the alleged targets. |
| Defense industry | U.S., South Korean and Taiwanese defense contractors are named. |
| Other industry | A Chinese energy company is also identified. |
Did the attackers hack NASA itself?
The specific NASA entity identified by the DOJ is the Office of Inspector General. That is a NASA component, but the announcement does not establish that every NASA system or the agency as a whole was compromised.
What information was allegedly stolen?
Prosecutors say the intrusions yielded terabytes of data, including unclassified information about U.S. government employees, older technical information related to military aircraft, intellectual property and limited technical material concerning maritime and uranium-processing projects.
How the attackers allegedly got in
The DOJ says the group exploited known vulnerabilities that victims had not patched, including Log4Shell. Log4Shell is the widely disclosed vulnerability in the Apache Log4j logging component. In this case, the allegation is not that an unknown flaw was used, but that systems remained exposed after a known weakness had been publicized and fixes were available.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The charging documents and announcements do not provide a complete vulnerability-by-vulnerability list for every victim, so Log4Shell should be treated as an example of the alleged access methods, not as the explanation for every intrusion.
What Maui ransomware means in this case
Maui is the ransomware family the DOJ says was used against healthcare organizations. Ransomware typically blocks access to systems or data and demands payment for restoration or decryption. Here, the alleged consequence was operational: hospitals could not provide full and timely care while responding to the attack.
The government’s account links Maui to a broader North Korean operation rather than describing it as an isolated criminal scheme. The alleged proceeds were laundered and then reused to support espionage-oriented compromises.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Government actions and the reward
Cryptocurrency interdictions
The Justice Department announced the interdiction of approximately $114,000 in virtual-currency proceeds and related money-laundering transactions. It also referred to an earlier seizure of approximately $500,000. Those figures are separate amounts cited by the department; they are not a published total of all ransom money or all funds recovered.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Technical disruption
DOJ says Microsoft implemented technical measures to block Andariel access. It also points to Mandiant research describing the group’s tactics, techniques and procedures. The announcements do not claim that these steps eliminated the threat.
Best Value
Reward for information
The State Department offered up to $10 million for information leading to Rim’s location or identification. “Up to” is a maximum reward offer, not a statement that a payment has been made.
What is still not publicly established
- The government materials do not give a complete list of hospitals involved.
- They do not state a total hospital count, aggregate ransom demand or total number of affected patients.
- They do not establish that every named organization suffered the same type or extent of compromise.
- They do not provide a public finding of guilt; the charges remain pending allegations.
Why this case matters
The indictment describes a financing loop: attacks on a safety-critical sector allegedly generated cryptocurrency, laundering concealed the proceeds, and the money supported later intelligence operations. It also connects basic defensive failures—such as leaving known vulnerabilities unpatched—with a campaign that reached healthcare, government, military and industrial targets.
Deputy Attorney General Lisa Monaco said the charges demonstrate that the United States will be “relentless against malicious cyber actors targeting our critical infrastructure.” FBI Deputy Director Paul Abbate said Rim and his alleged co-conspirators used ransomware against hospitals and healthcare companies and then laundered the proceeds to help fund North Korea’s illicit activities. Those statements describe the government’s position; the court has yet to test the allegations at trial.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
