North Korea May Be Linked To WannaCry Ransomware, Researchers Say

Adjust Comment Print

Several security researchers studying "WannaCry" said they found evidence of possible connections to those like the crippling hack on Sony Pictures Entertainment in 2014 attributed by the US government to North Korea (See: US sees North Korea hand in Sony hack). Operation Blockbuster-an alliance of key IT security firms working to combat multiple cyberespionage campaigns-had earlier discovered that Lazarus operates as a "malware factory" that produces new samples of malicious code through independent entities.

The United States likely avoided greater harm as the attack targeted older versions of Microsoft Corp's Windows operating system, and more US users have licensed, up-to-date, patched versions of the software, compared to other regions of the world.

US officials blamed both hacks on North Korea. High-end estimates of the hackers' take say they collected less than $70,000 by Monday afternoon, although Bitcoin experts say the actual profits could be even lower because some of the transactions hitting the criminals' Bitcoin account appear to be test transactions and fluctuations in the notoriously volatile Bitcoin currency must be considered.

"We are working on it".

WannaCry, the computer worm that's been infecting PCs running on Microsoft Windows servers in 150 countries, resembles earlier cyberattacks linked to North Korea, a South Korean cybersecurity expert told Reuters on Tuesday.

Google security researcher Neel Mehta sent out a tweet Monday linking two samples of malicious code: One from an early version of WannaCry and the other from the Lazarus Group, a collection of cybercriminals reportedly affiliated with North Korea.

US and European security officials told Reuters on condition of anonymity that it was too early to say who might be behind the attacks, but they did not rule out North Korea as a suspect.

This news also comes in the wakes by comments by Microsoft's President and Chief Legal Officer implicating government agencies - the NSA in particular - of maintaining an inventory of such cyber weaponry.

The code used in the latest attack shared many similarities with past hacks blamed on the North, including the targeting of Sony Pictures, said Simon Choi, director of Seoul internet security firm Hauri.

Kurdish-Led SDF Closing In On IS-Held Raqqa, Groups Report
Even if Ankara could get US courts to act, a quick decision in the Gulen case was unlikely, Arslan said via e-mail. Washington, meanwhile, has suggested it will attempt to assuage Turkey's concerns by supporting Turkish security.

"The North Koreans have really perfected their networks and driven them deep underground", Acting Assistant Secretary of State Susan Thornton said at forum in Washington late last month.

Russian Federation has recently been accused of cyber meddling in several countries, but Putin said his country had nothing to do with the attack.

Clues pointed to Lazarus, and the U.S. Federal Bureau of Investigation went on to conclude that North Korea was behind the breach.

"I'm not going to talk about various policy options that we may or may not consider, but I will say this: we are certainly engaged right now in looking at a number of measures - political, economic, security - to deal with these provocative acts by the DPRK, and risky acts in many cases", he said.

USA authorities, however, say the code in question is not a large portion of the overall Wannacry malware so it's plausible that the attackers got it from sources other than the National Security Agency.

"The real situation may be serious".

Following a UN Security Council directive ordering North Korea to cease all ballistic missile and nuclear weapons developments, a South Korean minister said Tuesday that Pyongyang is making progress on its missile program faster than expected, APA reports quoting Sputnik.

Homeland security adviser Tom Bossett told reporters he is not aware of a case where transferring $300 (£232) in Bitcoin - the amount demanded from victims of last week's attack - has "led to any data recovery".

Taiwan Power Co. said that almost 800 of its computers were affected, although these were used for administration, not for systems involved in electricity generation.

Comments