Story image

North Korea's nefarious links to cryptocurrency theft

18 Sep 2017

North Korean state-sponsored actors may be behind campaigns to steal virtual currencies in order to fund the state’s activities, according to speculation from security firm FireEye.

Last year the firm saw evidence that North Korean actors were targeting banks and the global financial system, possibly to fund Pyongyang’s elite.

Since May 2017, the North Korean actors have hit at least three South Korean cryptocurrency exchanges to steal funds, prompting the second wave of the campaign, FireEye researcher Luke McNamara says.

The actors used spearphishing methods to target employees at digital currency agencies. Those methods included tax themes as bait and banking malware linked to other North Korean actors.

“Add to that the ties between North Korean operators and a watering hole compromise of a bitcoin news site in 2016, as well as at least one instance of usage of a surreptitious cryptocurrency miner, and we begin to see a picture of North Korean interest in cryptocurrencies, an asset class in which bitcoin alone has increased over 400% since the beginning of this year,” McNamara says.

He points out that there have been six bursts of activity by North Korean actors against South Korean cryptocurrency targets between April and July.

In April, a suspected attack on four wallets in South Korean cryptocurrency exchange Yapizon may be linked, although there is no clear evidence North Korea was involved.

Four days later, the United States placed higher economic sanctions against North Korea, which may be growing North Korea’s interest in cryptocurrency.

In May, two South Korean exchange targets were hit by spearphishing campaigns. In June, more attacks against cryptocurrency providers were carried out. In July, the third known spearphishing attack against personal accounts was conducted.

According to McNamara, cryptocurrency exchanges make up just part of North Korea’s financial crime. He cites Office 39 as being involved in gold smuggling and creating counterfeit currency.

“If actors compromise an exchange itself (as opposed to an individual account or wallet) they potentially can move cryptocurrencies out of online wallets, swapping them for other, more anonymous cryptocurrencies or send them directly to other wallets on different exchanges to withdraw them in fiat currencies such as South Korean won, US dollars, or Chinese renminbi.”

He also says that because regulations around cryptocurrency are still developing, some countries may have insufficient money laundering laws, making it easier for attackers to mine cryptocurrencies.

McNamara notes that nations are becoming interested in cryptocurrencies, including Russia and Australia.

“Consequently, it should be no surprise that cryptocurrencies, as an emerging asset class, are becoming a target of interest by a regime that operates in many ways like a criminal enterprise. While at present North Korea is somewhat distinctive in both their willingness to engage in financial crime and their possession of cyber espionage capabilities, the uniqueness of this combination will likely not last long-term as rising cyber powers may see similar potential. Cyber criminals may no longer be the only nefarious actors in this space,” McNamara concludes.

Forget endpoints—it’s time to secure people instead
Security used to be much simpler: employees would log in to their PC at the beginning of the working day and log off at the end. That PC wasn’t going anywhere, as it was way too heavy to lug around.
DimData: Fear finally setting in amongst vulnerable orgs
New data ranking the ‘cybermaturity’ of organisations reveals the most commonly targeted sectors are also the most prepared to deal with the ever-evolving threat landscape.
IXUP goes "post-quantum" with security tech upgrade
The secure analytics company has also partnered with Deloitte as a reseller, and launched a SaaS offering on Microsoft Azure.
ExtraHop’s new partner program for enterprise security
New accreditations and partner portal enable channel partners to fast-track their expertise and build their security businesses.
Hackers increasingly ‘island hopping’ – so what does it mean?
Carbon Black's Rick McElroy discusses this new trend and what it means for the new age of cybercrime.
Trust without visibility is blind – Avi Networks
Enterprises are wanting to gain the trust of their customers, but are often found blindly defending themselves.
How to avoid becoming a cryptojacking victim - Bitglass
Large-scale cryptojacking is a lucrative business due to the popularity and value of cryptocurrencies like Bitcoin and Ethereum.
Symantec, Ixia combine efforts to secure hybrid networks
Ixia’s CloudLens and Symantec Security Analytics now feature complete integration, which allows Symantec customers to gain real-time visibility into their hybrid cloud environments.