Publications
Partners
Hong Kong - Cyber security researchers at Symantec and FireEye have uncovered more evidence tying this month’s WannaCry global ransomware attacks to North Korea.
The cyber attack that infected hundreds of thousands of computers worldwide was “highly likely” to have originated with Lazarus, a hacking group linked to the reclusive state, Symantec said. The software used was virtually identical to versions employed in attacks earlier this year attributed to the same agency, the company said in a report late on Monday.
FireEye on Tuesday agreed WannaCry shared unique code with malware previously linked to North Korea. “The shared code likely means that, at a minimum, WannaCry operators share software development resources with North Korean espionage operators,” Ben Read, a FireEye analyst, said in an emailed statement.
North Korean diplomats and official media have denied in recent days that the country played any role in the attacks.
WannaCry, the malware behind a global cyber attack dubbed “unprecedented” by Europol, infected an estimated 200 000 computers worldwide, infiltrating global institutions from the UK’s National Health Service to FedEx and PetroChina.
It gave its victims 72 hours to pay typically $300 in bitcoin or risk permanent loss of data. As of last Friday however, the estimated total amount of ransom paid failed to hit six figures.
READ: Up to million computers hit in biggest cyber attack ever
The initial attack was stifled when a security researcher disabled a key mechanism used by the worm to spread, but experts said the hackers were likely to mount a second attack because so many users of personal computers with Microsoft operating systems couldn’t or didn’t download a security patch released in March labelled “critical”.
Last week, a Google researcher posted on Twitter that an early version of WannaCry shared some of the same programming code as malicious software used by Lazarus, the alleged North Korean government hackers behind an attack on Sony in 2014 and the theft of $81m from a Bangladeshi central bank account at the New York Fed last year.
Other researchers have speculated that if the perpetrators were indeed North Korean, their intent may have been to cause a widespread internet outage to coincide with a scheduled missile test.
“Despite the links to Lazarus, the WannaCry attacks do not bear the hallmarks of a nation-state campaign but are more typical of a cybercrime campaign,” Symantec wrote in its report.
SUBSCRIBE FOR FREE UPDATE: Get Fin24's top morning business news and opinions in your inbox.
Read Fin24's top stories trending on Twitter: Fin24’s top stories
