The US says it’s identified three North Korean hackers who allegedly tried to steal $1.3 billion in cash and cryptocurrencies in an attempt to fund the country’s government.
The Justice Department claims the suspects are all members of Lazarus, the notorious hacking group behind the 2014 Sony Pictures breach and the WannaCry ransomware outbreak in 2017. The same group has also been tied to virtual bank and cryptocurrency heists across the globe.
On Wednesday, federal officials unsealed an indictment against the three suspects, claiming they work for North Korea’s government through a military agency known as the Reconnaissance General Bureau.
The first suspect, a 36-year-old computer programmer named Park Jin Hyok, was originally charged in 2018 when federal officials announced it had identified a member of Lazarus. US investigators now say they’ve identified two other North Koreans in the group: 31-year-old Jon Chang Hyok and 27-year-old Kim Il.
The new indictment also ties the three North Koreans to numerous hacking crimes, including:
- Attempting to steal $1.2 billion from banks in Vietnam, Bangladesh, Taiwan, Mexico, Malta, and Africa by tampering with the SWIFT messaging system.
- Hacking ATM systems to withdraw $6.1 million in cash in Pakistan.
- Creating fake cryptocurrency applications to trick users into installing a backdoor into their computers.
- Trying to steal tens of millions of dollars from cryptocurrency companies.
- Developing a fake digital currency known as Marine Chain Token to swindle unsuspecting investors into giving up their funds.
The indictment doesn’t spell out how federal investigators linked the three North Koreans to the hacking crimes. But the document suggests the US has been tracking their activities. For example, the charges claim all three suspects have traveled to and worked from China and Russia, two countries the US often blames for sponsoring cyber-espionage.
“We can prove these allegations beyond a reasonable doubt using only unclassified, admissible evidence,” the US Assistant Attorney General John Demers said in today’s announcement.
Despite the indictment, the US doesn’t expect any of the defendants will face trial in the near future. All three suspects are believed to currently reside in North Korea, a country that has no extradition treaty with the US.
Nevertheless, the Justice Department says the indictment is a way to rally the world against North Korea’s computer hacking. Federal officials also hope publicizing the charges will educate businesses on the threat and spur US lawmakers to take further action. Also today, the US released an advisory documenting the fake cryptocurrency apps the Lazarus group has been creating to hack unsuspecting users.