Science & Tech · Cybersecurity · 4 hrs ago
North Korea-linked group likely behind GMO cyberattack
A North Korea-linked hacking group likely carried out an October cyberattack on GMO Internet Group, according to analysis cited by sources close to the matter.
The Japanese internet company said last week that customer information from its foreign exchange service was leaked and used in fraudulent transactions.
The attacker had threatened to publish customer information and launch a ransomware attack; some information was disclosed on Oct.
27.
Separately, GMO GlobalSign, an authentication-services subsidiary, said personal information belonging to at least 45,000 people at client companies was leaked through its employee ID management service.
Experts said a website presented as a place for victims to share information may have been created by the attacker to collect their details.
The websites used to claim responsibility and gather victim information shared design features and code, while other clues may have been planted to mislead investigators.
GMO has reported the incident to the Japanese government and is working to establish what happened.
An analysis by GMO Internet Group found that a North Korea-linked hacking group was likely behind an October cyberattack on the company, sources close to the matter said.
Five IP addresses used to access a website claiming responsibility matched addresses previously used by a North Korean hacking group, Kyodo News found with security experts.
The company appears to have reported the matter to the Japanese government and is working to determine the full circumstances.
Customer information linked to GMO’s foreign exchange trading service was leaked without authorisation and used in fraudulent transactions.
GMO GlobalSign said personal information belonging to at least 45,000 people at client companies had also been leaked through its employee ID management service.
- Who
- A North Korea-linked hacking group was likely behind the attack, according to an analysis by GMO Internet Group.
- What
- A cyberattack on GMO led to customer information being leaked and used in fraudulent transactions.
- When
- In October; the specific date of the attack is not stated.
- Where
- GMO Internet Group; the sources do not state where the attack took place.
- Why
- Not stated
This story does not have two clearly opposing sides.
The domain for the website claiming responsibility for the attack was acquired from a US company.
The victim information-sharing website was registered, according to security experts’ analysis.
GMO made the cyberattack public, two days after the information-sharing website was registered.
The information-sharing website was confirmed to be available.
Some customer information was disclosed after GMO did not respond to the hacker’s request.
Sources said an analysis by GMO Internet Group found a North Korea-linked hacking group was likely behind the attack.
- Likely perpetrator
- North Korea-linked hacking group
- Attack period
- October
- IP addresses
- Five addresses matched ones previously used by a North Korean hacking group
- Customer information
- GMO foreign exchange trading service data was leaked and used in fraudulent transactions
- GlobalSign data leak
- Personal information of at least 45,000 people at client companies
3 sources
What people are saying
pretty much identical