North Korea-linked hacking group likely behind GMO cyberattack: Sources - The Straits Times
A North Korea-linked hacking group was likely behind the cyberattack on GMO Internet Group in October, according to an analysis by the company and security experts.
An analysis by GMO Internet Group found that a North Korea-linked hacking group was likely behind the cyberattack on the company in October, sources close to the matter said on Nov 1. The company appears to have already reported the matter to the Japanese government and will now focus on determining the full circumstances.
Digital Evidence Points
Kyodo News, working with security experts, found that five IP addresses used to access a website claiming responsibility for the attack matched those previously used by a North Korean hacking group. The website contained traces linked to multiple countries, including the United States and Japan, suggesting the hacker may have tried to mislead investigators through a false flag operation.
The two websites have similar overall designs and share parts of their source code, making them 'pretty much identical.'
Attack Details
Last week, GMO confirmed that customer information related to its foreign exchange trading service was leaked without authorization and used in fraudulent transactions. The hacker threatened to disclose customer information and conduct a ransomware attack. GMO did not respond to the request, and some customer information was disclosed on Oct 27.
GMO GlobalSign K.K., the company's authentication business subsidiary, said personal information of at least 45,000 people at client companies had been leaked through its employee ID management service. One victim reported receiving multiple emails on Oct 22 from someone using a Russian-sounding name claiming to be the attacker.
Related
