‘Unit 180’ worries the West
> Pyongyang’s hacker cell behind many bold cyber attacks: Experts
SEOUL: North Korea’s main spy agency has a special cell called Unit 180 that is likely to have launched some of its most daring and successful cyber attacks, according to defectors, officials and internet security experts.
North Korea has been blamed in recent years for a series of online attacks, mostly on financial networks, in the US, South Korea and over a dozen other countries.
Cyber security researchers have also said they have found technical evidence that could link North Korea with the WannaCry “ransomware” that infected more than 300,000 computers in 150 countries this month.
The crux of the allegations against North Korea is its ties to a hacking group called Lazarus that is linked to last year’s US$81 million (RM350 million) cyber heist at the Bangladesh central bank and the 2014 attack on Sony’s Hollywood studio.
Washington has blamed the North for the Sony hack and US officials have said prosecutors are building a case against Pyongyang in the Bangladesh Bank theft.
Kim Heung-kwang, a former computer science professor in North Korea who defected to the South in 2004 and still has sources inside the North, said Pyongyang’s cyber attacks aimed at raising cash are likely organised by Unit 180, a part of the Reconnaissance General Bureau, its main overseas intelligence agency.
“Unit 180 is engaged in hacking financial institutions (by) breaching and withdrawing money out of bank accounts.
“The hackers go overseas to find somewhere with better internet services than North Korea so as not to leave a trace.”
Kim said it was likely they went under the cover of being employees of trading firms, overseas branches of North Korean companies, or joint ventures in China or Southeast Asia.
James Lewis, a North Korea expert at the Washington-based Centre for Strategic and International Studies, said hacking was first used as a tool for espionage and then political harassment against South Korean and US targets.
“They changed after Sony by using hacking to support criminal activities to generate hard currency for the regime,” he said.
“So far, it’s worked as well or better as drugs, counterfeiting, smuggling – all their usual tricks.”
“North Korea is carrying out cyber attacks through third countries to cover up the origin of the attacks and using their information and communication technology infrastructure,” Ahn Chong-ghee, South Korea’s vice foreign minister, told Reuters.
Some attacks were conducted from a base in China, according to Simon Choi, a senior security researcher at Seoul-based antivirus company Hauri Inc.
Malaysia has also been a base for North Korean cyber operations, according to former South Korean police researcher Yoo Dong-ryul.
“They work in trading or IT programming companies on the surface. Some of them run websites and sell game and gambling programmes”. – Reuters