Things have been rough in North Korea since President Donald Trump stepped up the pressure. Reports say gasoline and other basic resources have run dry, and the regime is growing increasingly desperate for cash.
So desperate, Kim Jong Un may have ordered this weekend’s global cyberattack that ransomed computers back to their users… and it netted a paltry $30,000 in bitcoins.
That’s not exactly going to shower the country in riches.
Cybersecurity experts are pointing to circumstantial evidence that North Korea may be behind the global “ransomware” attack: the way the hackers took hostage computers and servers across the world was similar to previous cyberattacks attributed to North Korea.
Simon Choi, a director at South Korean anti-virus software company Hauri Inc. who has analyzed North Korean malware since 2008 and advises the government, said Tuesday that the North is no newcomer to the world of bitcoins. It has been mining the digital currency using malicious computer programs since as early as 2013, he said.
In the attack, hackers demand payment from victims in bitcoins to regain access to their encrypted computers. The malware has scrambled data at hospitals, factories, government agencies, banks and other businesses since Friday, but an expected second-wave outbreak largely failed to materialize after the weekend, in part because security researchers had already defanged it .
Choi is one of a number of researchers around the world who have suggested a possible link between the “ransomware” known as WannaCry and hackers linked to North Korea. Researchers at Symantec and Kaspersky Lab have found similarities between WannaCry and previous attacks blamed on North Korea.
While Choi’s speculation may deepen suspicions that the nuclear-armed state is responsible, the evidence is still far from conclusive. Authorities are working to catch the extortionists behind the global cyberattack, searching for digital clues and following the money.
This method, which allows quick and massive infections of computers with security weaknesses, has been found in previously known North Korean cyberattacks, including the Sony hack in 2014 blamed on North Korea.
“Since a July 2009 cyberattack by North Korea, they used the same method,” Choi said. “It’s not unique in North Korea but it’s also not a very common method.”
Choi also cited an accidental communication he had last year with a hacker traced to a North Korean internet address who admitted development of ransomware.
South Korea was mostly spared from the latest ransomware attack, partly because constant threats from the North have made the government and companies careful about always updating their software.
South Korea has been a frequent target of cyberattacks that it traced to its northern neighbor. Some high-profile attacks between 2009 and 2013 shut down government websites, banking systems and paralyzed broadcasters.
The Associated Press contributed to this article