North Korean Lazarus Group hackers indicted in US

The three named individuals, Jon Chang-Hyok (31), Kim Il (27) and Park Jin-Hyok (36), are alleged to be members of units of North Korea’s Reconnaissance General Bureau (RGB), which goes by many other names in the security community, perhaps most notably Lazarus Group, but also APT38.

Their schemes include the November 2014 attack on Sony Pictures Entertainment, conducted in revenge for the release of the Seth Rogen and Evan Goldberg movie The Interview, which depicted the assassination of North Korea’s leader; attacks on US cinema chain AMC Theatres; and a subsequent 2015 attack on Mammoth Screen, the production company behind Poldark, which was planning an unmade Channel 4 drama set in North Korea.

The trio also attempted to steal over $1.2bn from banks in Africa, Bangladesh, Malta, Mexico and Vietnam by hacking into their networks and sending fraudulent messages through the Society for Worldwide Interbank Financial Telecommunication (Swift), as well as a number of cyber-enabled ATM cash-out thefts, including the October 2018 theft of $6.1m from BankIslami in Pakistan.

They are further implicated in the creation of the destructive WannaCry 2.0 ransomware in May 2017, which disrupted services at one-third of NHS trusts and resulted in more than 19,000 GP appointments being cancelled, costing the health service over £90m, as well as the extortion of other victims from 2017 through 2020. The US Cybersecurity and Infrastructure Security Agency (CISA) has additionally published a new advisory today on the malware used.

The group also created and deployed a number of malicious cryptocurrency applications between March 2018 and September 2020 that were, in fact, backdoors into their victims’ computers, and targeted and stole tens of millions of dollars’ worth of cryptocurrency. In addition, it developed and marketed a blockchain-supported investment vehicle that ostensibly was designed to allow investors to buy interests in marine shipping vessels, but was, in fact, a means for the North Korean government to obtain funding, control its own merchant marine and evade international sanctions.

CISA has additionally published a new advisory today on the malware used in the Lazarus Group’s crypto-heists, referred to as AppleJeus.

All three men are alleged to have been, at times, stationed in other countries, including China and Russia. They have been charged with one count of conspiracy to commit computer fraud and abuse, which carries a maximum sentence of five years in prison, and one count of conspiracy to commit wire fraud and bank fraud, which carries a maximum sentence of 30 years in prison.

As is standard in such cases, these charges are accusations, and the standard caveats around the presumption of innocence until proven guilty apply.

The other charges – against Ghaleb Alaumary, 37, a resident of Mississauga, a suburb of Toronto in Canada – relate to money laundering ATM cash-out thefts, other cyber-heists, business email compromise (BEC) schemes, and other fraudulent activity. Alaumary was specifically involved in the raid on Pakistan’s BankIslami and other heists against targets in Malta. He conspired in this last instance with Ramon Olorunwa Abbas, aka Ray Hushpuppi, who was charged in a previous BEC indictment. As previously stated, Alaumary has agreed to plead guilty to a count of conspiracy to commit money laundering.

Further to the charges and new security advisory announced today, the US Attorney’s Office and the FBI have also obtained seizure warrants authorising the FBI to take back cryptocurrency stolen by Lazarus Group from a New York-based financial services company to the tune of $1.9m.

“The European Union’s July 2020 sanctions related to the Lazarus Group were a welcome development. We commend the EU for its initial efforts to impose consequences for state-sponsored malicious cyber activities”