North Korea-linked hackers behind GMO cyberattack: evidence — SkimNews
Get the Geopolitics newsletter
Daily geopolitics — wars, elections, sanctions, the diplomatic moves that move markets. Free.
- GMO Internet Group confirmed a cyberattack in October that led to unauthorized leaks of customer data from its foreign exchange service, which were used in fraudulent transactions
- North Korea-linked hacking group is likely responsible for the attack, according to analysis by GMO and Kyodo News, based on malware characteristics and IP addresses tied to prior North Korean operations
- Kyodo News and security experts identified five IP addresses used to access the hacker’s claim-of-responsibility website that match those previously used by North Korean operatives
- The hacker’s website displayed signs of a false flag operation, with server infrastructure from a US company, English OS settings, and US time zone file creation, while also containing AI-generated Japanese text in log-collection software
- A victim information-sharing website set up shortly before GMO went public about the breach bears nearly identical design and source code to the hacker’s site, suggesting it was created by the attacker to harvest victim data
Why it matters: At least 45,000 people’s personal information was leaked through GMO GlobalSign K.K.’s service, and the attackers actively exploited trust by mimicking a support platform. The use of AI-generated traces and multi-country digital misdirection raises the bar for attribution, making response and prevention harder for firms facing state-linked cybercrime.
Ask SkimNews
