North Korea trio accused by the U.S. in $1.3 billion extortion plot
The Justice Department on Wednesday unveiled charges against three North Korean hackers who are alleged to have tried to steal as much as $1.3 billion from banks, individuals and cryptocurrency organizations around the world during the past four years.
The three individuals – Jon Chang Hyok, Kim Il and Park Jin Hyok – are part of North Korea’s military intelligence agency called the Reconnaissance General Bureau headquartered in Pyongyang, according to the indictment. The intelligence unit has also been identified by cybersecurity researchers as the Lazarus Group, or advanced persistent threat 38 – APT38 – the Justice Department said.
The same group of hackers also were behind the attack on Sony Pictures in November 2014 and U.S. movie theater chains after the entertainment company produced a movie called “The Interview,” which lampooned North Korean ruler Kim Jong Un, the Justice Department said.
The indictment listed 45 “overt acts” of cyberattacks, including spear phishing email assaults, attacks on bank ATMS, cryptocurrency heists, extortions and ransomware.
North Korea’s economy has for decades suffered from global economic sanctions imposed because of the country’s pursuit of nuclear weapons, and the country uses cyberattacks as a way to steal money from around the world to keep the regime going, John
Demers, a U.S. assistant attorney general, said at a news conference.
Unlike China, Russia, and Iran, which use cyberattacks to further their foreign policy goals, or disrupt western democracies and steal technologies, North Korean hackers are “very focused on currency” theft, Demers said.
“North Korea’s operatives, using keyboards rather than guns, stealing digital wallets of cryptocurrency instead of sacks of cash, are the world’s leading 21st century nationstate bank robbers,” Demers said.
The indictment “describes in stark detail how the (North Korea) cyber threat has followed the money and turned its revenue generation sights on the most cutting edge aspects of international finance, including through the theft of cryptocurrency from exchanges and other financial institutions, in some cases through the creation and deployment of cryptocurrency applications with hidden backdoors,” Demers said.
While the hackers operated mostly from Pyongyang, they also are alleged to have carried out their cyberattacks at times from China and Russia, the Justice Department said. China and Russia, in addition to carrying out their own cyberattacks, are providing “safe harbor for cyber criminals or in this case other nation-state hackers to act,” Demers said.
The indictment outlines eight different cases of the North Korean hackers targeting banks around the world, including those in the Philippines, Poland, Vietnam, South Korea, Malta, an unnamed African country and Bangladesh. In the case of Bangladesh, the hackers are said to have made off with about $81 million.
The Justice Department also announced that it had arrested Ghaleb Alaumary, a U.s.-canadian dual citizen who’s alleged to have helped North Korea launder its stolen money.
The indictment describes five major extortion and ransomware attacks carried out by the hackers including Wannacry, a devastating attack in May 2017 that froze the computers at hundreds of hospitals around the world.