North Korea-linked hacking group likely behind GMO cyberattack: Sources

An analysis by GMO Internet Group found that a North Korea-linked hacking group was likely behind the cyberattack on the company in October, sources close to the matter said on Nov 1, citing characteristics of the malware used and other traces left by the perpetrators.The company appears to have already reported the matter to the Japanese government and will now focus on determining the full circumstances.Kyodo News, working with security experts, also found that five IP addresses used to access a website claiming responsibility for the attack immediately after the site went online matched those previously used by a North Korean hacking group.The website contained traces linked to multiple countries, including the United States and Japan, suggesting the hacker may have tried to mislead investigators through a false flag operation, cybersecurity sources said on Nov 1.A separate analysis of the site found that its domain had been acquired from a US company on Sept 1 and that its hosting server was provided by the same company.File creation times were set to a US time zone, while the operating system was set to English.Part of a programme used to collect visitor logs contained Japanese text and showed characteristics suggesting it had been generated by artificial intelligence.Files posted on the site were created using software developed in China and widely used there.A website for victims of the GMO cyberattack to share information may have been set up by the attacker, as its web structure bears many similarities to that of the site used to claim responsibility for the attack, an analysis by security experts found on Oct 31.The attacker possibly sought to get information from victims through the “victim information sharing forum” website, the experts said.The website was registered on Oct 19, two days before the Japanese internet infrastructure provider made the cyberattack public, according to the analysis. The information-sharing website was confirmed to be available as of Oct 22.The two websites have similar overall designs and share parts of their source code, making them “pretty much identical,” one of the experts said.Last week, the company confirmed that customer information related to its foreign exchange trading service was leaked without authorisation and used in fraudulent transactions.The hacker threatened to disclose customer information and conduct a ransomware attack. GMO did not respond to the request, and some customer information was disclosed on Oct 27.One of the victims said they received multiple emails on the night of Oct 22 from someone using a Russian-sounding name claiming to be the attacker.Meanwhile, GMO GlobalSign K.K., the company’s authentication business subsidiary, said personal information of at least 45,000 people at client companies had been leaked through its employee ID management service. KYODO NEWS