Similarities spotted between details of last week’s massive cyber-attack and code used by a prolific cybergang with links to North Korean government

This article is more than 2 years old

This article is more than 2 years old

Two top security firms have found evidence linking the WannaCry ransomware to the prolific North Korean cybergang known as Lazarus Group.

What is WannaCry ransomware and why is it attacking global computers? Read more

Kaspersky and Symantec both said on Monday that technical details within an early version of the WannaCry code are similar to code used in a 2015 backdoor created by the government-linked North Korean hackers, who were implicated in the 2014 attack on Sony Pictures and an $81m heist on a Bangladeshi bank in 2016. Lazarus Group has also been known to use and target Bitcoin in its hacking operations. The similarities were first spotted by Google security researcher Neal Mehta and echoed by other researchers including Matthieu Suiche from UAE-based Comae Technologies.

Matthieu Suiche (@msuiche) Similitude between #WannaCry and Contopee from Lazarus Group ! thx @neelmehta - Is DPRK behind #WannaCry ? pic.twitter.com/uJ7TVeATC5

Shared code doesn’t always mean the same hacking group is responsible – an entirely different group may have simply re-used Lazarus group’s backdoor code from 2015 as a “false flag” to confuse anyone trying to identify the perpetrator. However the re-used code appears to have been removed from later versions of WannaCry, which according to Kaspersky gives less weight to the false flag theory.

“We believe it’s important that other researchers around the world investigate these similarities and attempt to discover more facts about the origin of WannaCry,” said Kaspersky Lab in a blogpost, pointing out that in the early days of the Bangladesh bank attack, there were scant clues linking it to the Lazarus group. However, over time researchers found more clues to build the case against the North Korea-linked cybergang.

Kaspersky is among the research teams to have been studying Lazarus Group for years, and in April it published a detailed “under the hood” report exposing the group’s modus operandi.

“This level of sophistication is something that is not generally found in the cybercriminal world. It’s something that requires strict organization and control at all stages of operation. That’s why we think that Lazarus is not just another advanced persistent threat actor,” said Kaspersky, which also found attacks originating from IP addresses in North Korea.

The WannaCry ransomware attack has now now hit more than 200,000 computers in 150 countries, crippling hospitals, governments and businesses.

How to protect your computer against the ransomware attack Read more

The links to North Korea come at a time when security researchers and technology companies are criticizing the US government for stockpiling cyberweapons including the malicious software used in WannaCry.

The WannaCry exploits used in the attack were drawn from a cache of exploits stolen from the NSA by the Shadow Brokers in August 2016. The NSA and other government agencies around the world create and collect vulnerabilities in popular pieces of software (such as Windows) and cyberweapons to use for intelligence gathering and cyberwarfare.

Once these vulnerabilities were leaked by the Shadow Brokers, they became available for cybercriminals to adapt for financial gain by creating ransomware. This ransomware spread rapidly on Friday by exploiting a vulnerability contained in the NSA leak, targeting computers running Microsoft’s Windows operating system, taking over users’ files and demanding $300 to restore them.

Facebook Twitter Pinterest Employees monitor possible ransomware cyber-attacks at the Korea Internet and Security Agency (Kisa) in Seoul, South Korea, on 15 May. Photograph: YONHAP/EPA

“This attack provides yet another example of why the stockpiling of vulnerabilities by governments is such a problem,” said Brad Smith, president and chief legal officer of Microsoft, in a blogpost.

“Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage. An equivalent scenario with conventional weapons would be the US military having some of its Tomahawk missiles stolen.”

The blogposts mentions that vulnerabilities stockpiled by the CIA also ended up in the public domain via Wikileaks.

'Accidental hero' halts ransomware attack and warns: this is not over Read more

“This is an emerging pattern in 2017,” Smith said, adding that the latest attack represents a “completely unintended but disconcerting link” between nation-state action (the NSA) and organized criminal action (the ransomware creator).

“The governments of the world should treat this attack as a wake-up call,” said Smith, urging nations to treat cyber weapons in the same way that physical weapons are treated.

“We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits.”

Jeremy Wittkop, chief technology officer of security company Intelisecure, argues that if governments are to stockpile weapons they need to secure them better.

“The government has a responsibility like with nuclear weapons to make sure they don’t fall into the hands of the wrong people,” he said. “If you are going to create something that can cause this much damage you have to protect it.”

Microsoft has called for a “Digital Geneva Convention” requiring governments to report vulnerabilities to the creators of the software instead of stockpiling, selling or exploiting them.</s>SEOUL, South Korea — They take legitimate jobs as software programmers in the neighbors of their home country, North Korea. When the instructions from Pyongyang come for a hacking assault, they are believed to split into groups of three or six, moving around to avoid detection.

Ever since the 1980s, reclusive North Korea has been known to train cadres of digital soldiers to engage in electronic warfare and profiteering exploits against its perceived enemies, most notably South Korea and the United States. In more recent years, cybersecurity experts say, the North Koreans have spread these agents across the border into China and other Asian countries to help cloak their identities. The strategy also amounts to war-contingency planning in case the homeland is attacked.

Now this force of North Korean cyberhacking sleeper cells is under new scrutiny in connection with the ransomware assaults that have roiled much of the world over the past four days. New signs have emerged not only that North Koreans carried out the attacks but also that the targeted victims included China, North Korea’s benefactor and enabler.

As evidence mounts that North Korean hackers may have links to the ransom assaults that destroyed more than 200,000 computers, their motives appear twofold: financial gain — which does not appear to be turning out so well — and proof that Pyongyang has the means to cause significant damage, with or without a nuclear weapon.</s>The connection was first hinted at on Twitter by Neel Mehta, a Google security researcher. While the link is mostly speculative, researchers say the code is exclusive to North Korean hackers, who used an extremely similar version for three of the most prominent cyberattacks in recent history: the 2014 hack of Sony Pictures Entertainment, the 2016 hack of Bangladesh Central Bank, and a February hack of several Polish banks. Still, both the Kaspersky Lab and Symantec—which has previously identified hacks carried out by the United States, Israel, and North Korea—said they would need to investigate further before confirming North Korea’s involvement.

In the wake of Friday’s global cyberattack that disrupted around 300,000 computer systems in more than 150 nations, cybersecurity experts speculated that uncovering the perpetrator could take months of investigation. While this might still be true, a group of cybersecurity researchers has confirmed the first piece of legitimate evidence linking the ransomware to North Korean hackers. On Monday, researchers from two cybersecurity providers—the American software company Symantec and the Russian-based Kaspersky Lab—revealed that some of the code used in the ransomware, known as WannaCry, was nearly identical to code used by the Lazarus Group, a North Korean hacking operation.

“At this time, all we have is a temporal link,” Eric Chien, an investigator at Symantec, told The New York Times. But Kurt Baumgartner, a researcher at the Kaspersky Lab, insisted to Reuters that it was “the best clue we have seen to date as to the origins of WannaCry.” Meanwhile, a third cybersecurity firm, FireEye, Inc., told Reuters the similarities were not unique enough to suggest a correlation.

There are many reasons for cybersecurity experts to be skeptical of the link to North Korea. For one, hackers have a tendency to steal or modify each other’s codes, and might also be inclined to trick investigators by introducing a “false flag.” Some experts also speculate that not one, but two, sources were responsible for the attack, since certain parts were coded differently. Amanda Rousseau, a malware researcher at the security firm Endgame, affirmed this theory to CNN, while also introducing the idea that the perpetrator was an inexperienced hacker, since the ransomware was relatively easy to reverse engineer.

Another obstacle to identifying the culprit is the lack of a clear motivation. Previous hacks attributed to the Lazarus Group have resulted in much larger thefts, with the organization garnering $81 million in the Bangladesh heist alone. As a result, some cybersecurity experts believe that Friday’s hackers were looking to inflict widespread damage rather than pocket a large sum. And yet, the potential link to the Lazarus Group cannot be discounted. While he admits that attribution is difficult to pinpoint, Matt Suiche, a Dubai-based security researcher, told Wired it “would be a lot of trouble” for hackers “to write ransomware, target everyone in the world, and then make a fake attribution to North Korea.”

If North Korea is ultimately found responsible, the repercussions could be grave. “It could very well be considered an act of terrorism depending on who is behind the attack,” Michael Daly, the Chief Technology Officer at Raytheon Cybersecurity and Special Missions, said in an emailed statement. On Monday, President Trump’s Homeland Security Adviser, Thomas Bossert, said that both foreign nations and cyber criminals were considered suspects. “I don’t want to say we have no clues,” Bossert told White House reporters. “But I stand assured that the best and brightest are working on this hack.”</s>Since the 1980s, the reclusive North has been known to train cadres of digital soldiers to engage in electronic warfare and profiteering exploits against its perceived enemies, most notably South Korea and the United States.

They take legitimate jobs as software programmers in neighbors of their home country, North Korea. When the instructions from Pyongyang, the capital, come for a hacking assault, they are believed to split into groups of three or six, moving around to avoid detection.

Since the 1980s, the reclusive North has been known to train cadres of digital soldiers to engage in electronic warfare and profiteering exploits against its perceived enemies, most notably South Korea and the United States. In recent years, cybersecurity experts say, the North Koreans have spread these agents across the border into China and other Asian countries to help cloak their identities. The strategy also amounts to war-contingency planning in case the homeland is attacked.

This force of North Korean hacker sleeper cells is under new scrutiny in connection with the ransomware assaults that have roiled much of the world during the past few days. Signs have emerged that suggest North Koreans not only carried out the attacks, but that the targeted victims included China, North Korea’s benefactor and enabler.

While there is nothing definitive to link the attacks to North Korea, similarities exist between the ransomware used to extort computer users into paying the hackers and previously deployed North Korean malware codes.

Moreover, North Korea has in the past timed cyberattacks to coincide with its banned weapons tests — like the ballistic missile launched Sunday — as a way of subtly flaunting the country’s technological advances despite its global isolation.

Unlike its missile and nuclear-weapons tests, however, North Korea has never announced or acknowledged its computer-hacking abilities; if anything, the country has denied responsibility for hacking and other forms of computer crimes.

It also is possible that North Korea had no role in the attacks, which exploited a stolen hacking tool developed by the National Security Agency (NSA) of the United States. Early Tuesday, the Shadow Brokers, the hacking group that spread the tool and is not believed to be linked with North Korea, threatened in an online post to start a “Data Dump of the Month” club, in which it would release more NSA hacking methods to paying subscribers.

Security officials in South Korea, the United States and elsewhere say it is well-known that the North Korean authorities have long trained squads of hackers and programmers, both to sabotage computers of adversaries and make money for the government, including through the use of ransomware — malicious software that blackmails victims into paying to release seized files.

Choi Sang-myung, an adviser to South Korea’s cyberwar command and a security researcher at Hauri, said the arithmetic logic in the ransomware attacks that began on Friday and have hit more than 100 countries, including China, is similar to that used in previous attacks against Sony Pictures and the Swift international bank-messaging system — both of which were traced to North Korea.

He also said the technique used by the ransomware to erase a computer’s files resembled that used by the Lazarus Group, the name experts use to identify a North Korean group deemed responsible for the Sony assault.

Security experts at Symantec, which in the past has accurately identified attacks mounted by the United States, Israel and North Korea, found early versions of the ransomware, called WannaCry, that used tools that were also deployed against Sony Pictures Entertainment, the Bangladesh central bank last year and Polish banks in February. American officials said Monday that they had seen the same similarities.

All of those attacks were ultimately linked to North Korea; President Barack Obama formally charged the North in late 2014 with destroying computers at Sony in retaliation for a comedy, “The Interview,” that envisioned a CIA plot to kill Kim Jong Un, the country’s leader.

This would not be the first time North Korean hackers have resorted to ransomware attacks. In a hack last year of Interpark, a South Korean e-commerce provider, North Korean hackers used ransomware to hijack its systems and demanded payment in Bitcoin, a digital currency.

Boo Hyeong-wook, a research fellow at the government-financed Korea Institute for Defense Analyses in Seoul, said the scale of the most recent attacks was large enough that it was likely to have been supported on a national level.

He also said it would be a logical extension of the growing boldness of North Korean hackers to exploit their abilities to raise much-needed funds for the government, which has been starved of cash by international sanctions.

While North Korean hackers have for years operated out of China, defectors and South Korean officials say they have been spreading to Southeast Asian countries, where government monitoring is less intense.

In countries like Malaysia, many North Korean hackers are believed to work undercover at information-technology companies and other jobs with the veneer of respectability. Sometimes, the hackers will also run online gambling sites or use ransomware to raise funds for themselves.

Cybersecurity officials in South Korea and elsewhere say that when instructions come from their superiors in North Korea, these hackers are activated to attack targets.

North Korea began training electronic-warfare soldiers well before the internet era, according to defectors and South Korean officials. They selected mathematical prodigies when they were 12 or 13 and trained them to become software developers, online psychological-warfare experts and hackers.

They were also trained in foreign languages so that they could operate abroad. North Korea sends students to study in Russia and China, and more recently India, to learn software and programming techniques. They return home and some are hired as hackers.

The Workers’ Party and the Korean People’s Army are believed to run their own hacking operations, creating competition. That has led some to speculate that North Korean hackers sometimes leave clues behind, in part to ensure they get credit and win promotions in North Korea.

If the North Korean hackers were responsible for the disruptions suffered by Chinese computer users, that would constitute an extraordinary assault on North Korea’s most important neighbor.

Although China is a hotbed of malware, ransomware and all sorts of other malicious computer code, there is almost no example of North Korean hackers targeting the country to raise money.

Boo said the changing dynamics in the relationship between China and North Korea, which once described themselves as close as “lips and teeth,” could be why China was attacked.

“China has dialed up the pressure on North Korea,” Boo said. “Pyongyang faces the increased possibility that Beijing could abandon it. It made a loud statement.”</s>SAN FRANCISCO — It’s unclear who is responsible for the global cyberattack that targeted around 300,000 machines in 150 countries. Businesses are still reeling from the fallout, and government agencies around the world are investigating.

Security researchers have documented similarities between the WannaCry code and malware created by the North Korean hacking group called Lazarus Group. The code similarities were discovered by Google researcher Neel Mehta on Monday. Google declined to comment.

The security firm Symantec also found links between the Lazarus Group and WannaCry. It discovered early versions of WannaCry on systems that had been compromised by the Lazarus Group’s tools. These versions were different than the ransomware that spread on Friday. It is unclear whether the Lazarus Group put the ransomware on those systems, or someone else did.

“We have not yet been able to confirm the Lazarus tools deployed WannaCry on these systems,” a Symantec spokesperson said in a statement to CNNTech. “While these connections exist, they so far only represent weak connections. We are continuing to investigate for stronger connections.”

Kaspersky Lab, a security company, has also published the similarities. The Lazarus Group was linked to the 2014 hack of Sony Pictures and attacks on banks around the world.

The latest observations are still a long way from determining whether North Korean hackers were behind the recent global cyberattack, but they demonstrate how researchers go about finding who is to blame. One way is to investigate the code and compare it to samples that known hackers have used in the past.

According to Amanda Rousseau, malware researcher at security firm Endgame, it’s difficult to catch cybercriminals. Further, it will be hard to find patient zero, or the first victim that kicked off the spread of the virus.

The WannaCry ransomware took computers hostage by encrypting their files and requiring payment to unlock them. It leveraged a Windows vulnerability leaked in a trove of hacking tools believed to belong to the NSA. The ransomware mostly affects businesses and large organizations that use a Windows tool that enables file-sharing.

Microsoft released a patch for the vulnerability in March.

Rousseau says the malware code indicates there are at least two different parties responsible for it because there are two pieces of the attack that are coded differently. The ransomware itself was not hard to reverse engineer, she said, and indicates that a less experienced person wrote it.

Multiple government agencies are committed to tracking down the perpetrators.

Finding out who is responsible is called “attribution.” And it is very hard to do. Researchers look for certain identifiable pieces of code or clues on how it was executed, such as text strings or site registrations. But there are tools that hackers use to throw investigators off their tracks. Often, malware code is publicly available, or it can be purchased on digital black markets.

According to Michael Flossman, researcher at security firm Lookout, examining the victims can help narrow down the perpetrators — but in the case of WannaCry, hundreds of thousands of machines were affected and there weren’t a ton of similarities in who was hit.

The hackers responsible have not received much in return for their efforts. While the ransomware took down hospitals and critical infrastructure, it’s made less than $60,000 in ransom. Security researchers and government agencies have advised businesses not to pay the ransom.

Researchers are piecing together where WannaCry came from, and some insight into how hackers used the leaked Microsoft vulnerabilities could be found on the dark web.

The dark web is like a second layer of the internet beyond what average people use every day. It can only be accessed via the Tor browser, which gives users a cloak of anonymity and makes it impossible for anyone else to see their activity.

Cybersecurity firm CYR3CON collects information from dark web sites and uses it to understand cybersecurity threats. In mid-April, the firm identified a conversation on a popular Russian forum that discussed using the leaked NSA exploits to launch ransomware attacks against hospitals.

“The thing most interesting was a conversation that mentioned the specific Windows exploit,” Paulo Shakarian, cofounder and CEO of CYR3CON, told CNNTech. “It mentioned there were tens of thousands of systems that could be targeted, and many of them were in the medical industry.”

Though there were many dark web conversations around the tools after they were released in April, this specific thread talked about a ransomware attack strikingly similar to WannaCry.

It’s impossible to know who posted it, and it is not evidence that people who participated in the thread were responsible. But law enforcement and researchers can use this information to see what future attacks might look like so companies and users can defend themselves against hacks.

“It can give insight into what malicious hackers are looking to target, what tools they will use, and what is the established expertise,” Shakarian said.</s>SINGAPORE, May 16 (Reuters) - The WannaCry malware that spread to more than 100 countries in a few hours is throwing up several surprises for cybersecurity researchers, including how it gained its initial foothold, how it spread so fast and why the hackers are not making much money from it.

Some researchers have found evidence they say could link North Korea with the attack, but others are more cautious, saying that the first step is shedding light on even the most basic questions about the malware itself.

For one thing, said IBM Security's Caleb Barlow, researchers are still unsure exactly how the malware spread in the first place. Most cybersecurity companies have blamed phishing e-mails - e-mails containing malicious attachments or links to files - that download the ransomware.

That's how most ransomware finds its way onto victims' computers.

The problem in the WannaCry case is that despite digging through the company's database of more than 1 billion e-mails dating back to March 1, Barlow's team could find none linked to the attack.

"Once one victim inside a network is infected it propagates," Boston-based Barlow said in a phone interview, describing a vulnerability in Microsoft Windows that allows the worm to move from one computer to another.

The NSA used the Microsoft flaw to build a hacking tool codenamed EternalBlue that ended up in the hands of a mysterious group called the Shadow Brokers, which then published that and other such tools online.

But the puzzle is how the first person in each network was infected with the worm. "It's statistically very unusual that we'd scan and find no indicators," Barlow said.

Other researchers agree. "Right now there is no clear indication of the first compromise for WannaCry," said Budiman Tsjin of RSA Security, a part of Dell.

Knowing how malware infects and spreads is key to being able to stop existing attacks and anticipate new ones. "How the hell did this get on there, and could this be repeatedly used again?" said Barlow.

Some cybersecurity companies, however, say they've found a few samples of the phishing e-mails. FireEye said it was aware customers had used its reports to successfully identify some associated with the attack.

But the company agrees that the malware relied less on phishing e-mails than other attacks. Once a certain number of infections was established, it was able to use the Microsoft vulnerability to propagate without their help.

There are other surprises, that suggest this is not an ordinary ransomware attack.

Only paltry sums were collected by the hackers, according to available evidence, mostly in the bitcoin cryptocurrency.

There were only three bitcoin wallets and the campaign has far earned only $50,000 or so, despite the widespread infections. Barlow said that single payments in some other ransomware cases were more than that, depending on the victim.

Jonathan Levin of Chainalysis, which monitors bitcoin payments, said there were other differences compared to most ransomware campaigns: for instance the lack of sophisticated methods used in previous cases to convince victims to pay up. In the past, this has included hot lines in various languages.

And so far, Levin said, the bitcoin that had been paid into the attackers' wallets remained there - compared to another campaign, known as Locky, which made $15 million while regularly emptying the bitcoin wallets.

"They really aren't set up well to handle their bitcoin payments," Levin said.

The lack of sophistication may bolster those cybersecurity researchers who say they have found evidence that could link North Korea to the attack.

A senior researcher from South Korea's Hauri Labs, Simon Choi, said on Tuesday the reclusive state had been developing and testing ransomware programs only since August. In one case, the hackers demanded bitcoin in exchange for client information they had stolen from a South Korean shopping mall.

Choi, who has done extensive research into North Korea's hacking capabilities, said his findings matched those of Symantec and Kaspersky Lab, who say some code in an earlier version of the WannaCry software had also appeared in programs used by the Lazarus Group, identified by some researchers as a North Korea-run hacking operation.

The Lazarus hackers have however been more brazen in their pursuit of financial gain than others, and have been blamed for the theft of $81 million from the Bangladesh central bank, according to some cybersecurity firms. The United States accused it of being behind a cyber attack on Sony Pictures in 2014.

Whoever is found to be behind the attack, said Marin Ivezic, a cybersecurity partner at PwC in Hong Kong, the way the hackers used freely available tools so effectively may be what makes this campaign more worrying.

By bundling a tool farmed from the leaked NSA files with their own ransomware, "they achieved better distribution than anything they could have achieved in a traditional way" he said.

"EternalBlue (the hacking tool) has now demonstrated the ROI (return on investment) of the right sort of worm and this will become the focus of research for cybercriminals," Ivezic said. (Additional reporting Ju-Min Park in Seoul, Editing by Raju Gopalakrishnan)</s>Cyber security researchers on Monday found possible North Korea links to the massive WannaCry “ransomware” cyber attacks that first started on May 12. Two security companies found evidence connecting the specific ransomware to North Korean cybergang Lazarus Group, The Guardian reported.

Google researcher Neel Mehta had also published data on Twitter linking the isolated nation to the extortion campaigns that have affected at least three lakh computers in 150 countries.

The two security companies Symantec and Kaspersky Lab said the WannaCry software had a code that was identified in the programmes used by the Lazarus group. “This is the best clue we have seen to date as to the origins of WannaCry,” Kaspersky Lab researcher Kurt Baumgartner told Reuters.

Unidentified officials from the United States and Europe told Reuters that that it was too early to confirm who was responsible for the attacks, but said that North Korea was in their list of suspects. “The similarities we see between malware linked to that group and WannaCry are not unique enough to be strongly suggestive of a common operator,” Cyber security firm FireEye’s researcher John Miller said.

Kaspersky Lab said, “This level of sophistication is something that is not generally found in the cybercriminal world. It’s something that requires strict organization and control at all stages of operation. That’s why we think that Lazarus is not just another advanced persistent threat actor”.

Security experts have warned that India’s banking system could be vulnerable to the attacks.

On Monday, the Indian government had warned users against opening unsolicited emails. The WannaCry virus encrypts the computer’s hard disk drive and then spreads the bug across systems in the same local area network. It also spreads through malicious attachments to emails.

The major cyber attack had targeted several nations, bringing operations at hospitals, telecommunications firms and other companies to a halt. CERT has suggested using patches in users’ Windows systems to prevent the bug from spreading. The ransomware also “drops a file named ‘!Please Read Me!.txt’ that contains the text explaining what has happened [to the computer] and how to pay the ransom”. Microsoft systems seem to be vulnerable to the attacks.</s>SEOUL, South Korea (AP) — Cybersecurity experts are pointing to circumstantial evidence that North Korea may be behind the global “ransomware” attack: the way the hackers took hostage computers and servers across the world was similar to previous cyberattacks attributed to North Korea.

Simon Choi, a director at South Korean anti-virus software company Hauri Inc. who has analyzed North Korean malware since 2008 and advises the government, said Tuesday that the North is no newcomer to the world of bitcoins. It has been mining the digital currency using malicious computer programs since as early as 2013, he said.

In the attack, hackers demand payment from victims in bitcoins to regain access to their encrypted computers. The malware has scrambled data at hospitals, factories, government agencies, banks and other businesses since Friday, but an expected second-wave outbreak largely failed to materialize after the weekend, in part because security researchers had already defanged it .

Choi is one of a number of researchers around the world who have suggested a possible link between the “ransomware” known as WannaCry and hackers linked to North Korea. Researchers at Symantec and Kaspersky Lab have found similarities between WannaCry and previous attacks blamed on North Korea.

While Choi’s speculation may deepen suspicions that the nuclear-armed state is responsible, the evidence is still far from conclusive. Authorities are working to catch the extortionists behind the global cyberattack, searching for digital clues and following the money.

“We are talking about a possibility, not that this was done by North Korea,” Choi said.

WannaCry paralyzed computers running mostly older versions of Microsoft Windows in some 150 countries. It encrypted users’ computer files and displayed a message demanding $300 to $600 worth of the digital currency bitcoin to release them; failure to pay would leave the data scrambled and likely beyond repair .

The hackers appeared to have taken control of computers and servers around the world by sending a type of malicious code known as a worm to file-sharing protocols. The worms quickly scanned computers with vulnerability, in this case the older versions of Microsoft Windows, and used those computers as hackers’ command and control centers.

This method, which allows quick and massive infections of computers with security weaknesses, has been found in previously known North Korean cyberattacks, including the Sony hack in 2014 blamed on North Korea.

“Since a July 2009 cyberattack by North Korea, they used the same method,” Choi said. “It’s not unique in North Korea but it’s also not a very common method.”

Choi also cited an accidental communication he had last year with a hacker traced to a North Korean internet address who admitted development of ransomware.

South Korea was mostly spared from the latest ransomware attack, partly because constant threats from the North have made the government and companies careful about always updating their software.

South Korea has been a frequent target of cyberattacks that it traced to its northern neighbor. Some high-profile attacks between 2009 and 2013 shut down government websites, banking systems and paralyzed broadcasters.

On Monday, the Russian security firm Kaspersky Lab said portions of the WannaCry program use the same code as malware previously distributed by the Lazarus Group, a hacker collective behind the 2014 Sony hack.

But it’s possible the code was simply copied from the Lazarus malware without any other direct connection. Kaspersky said “further research can be crucial to connecting the dots.”

Another security company, Symantec, has also found similarities between WannaCry and Lazarus tools, and said it’s “continuing to investigate for stronger connections.”

If North Korea, believed to be training cyber warriors at schools, is indeed responsible for the latest attack, Choi said the world should stop underestimating its capabilities and work together to think of a new way to respond to cyber threats, such as having China pull the plug on North Korea’s internet.

“We have underestimated North Korea so far that since North Korea is poor, it wouldn’t have any technologies. But North Korea has been preparing cyber skills for more than 10 years and its skill is significant. We should never underestimate it,” Choi said.

Researchers might find some additional clues in the bitcoin accounts accepting the ransom payments. There have been three accounts identified so far, and there’s no indication yet that the criminals have touched the funds.

Although bitcoin is anonymized, researchers can watch it flow from user to user. So investigators can follow the transactions until an anonymous account matches with a real person, said Steve Grobman, chief technology officer with the California security company McAfee.

But that technique is no sure bet. There are ways to convert bitcoins into cash on the sly through third parties. And even finding a real person might be no help if they’re in a jurisdiction that won’t cooperate.

James Lewis, a cybersecurity expert at the Center for Strategic and International Studies in Washington, said U.S. investigators are collecting forensic information — such as internet addresses, samples of malware or information the culprits might have inadvertently left on computers — that could be matched with the handiwork of known hackers.

Investigators might also be able to extract some information about the attacker from a previously hidden internet address connected to WannaCry’s “kill switch.” That switch was essentially a beacon sending the message “hey, I’m infected” to the hidden address, Weaver said.

That means the very first attempts to reach that address, which might have been recorded by spy agencies such as the NSA or Russian intelligence, could lead to “patient zero” — the first computer infected with WannaCry. That, in turn, might further narrow the focus on possible suspects.

Forensics, though, will only get investigators so far. One challenge will be sharing intelligence in real time to move as quickly as the criminals — a tricky feat when some of the major nations involved, such as the U.S. and Russia, distrust each other.

Even if the perpetrators can be identified, bringing them to justice could be another matter. They might be hiding out in countries that wouldn’t be willing to extradite suspects for prosecution, said Robert Cattanach, a former U.S. Justice Department attorney and an expert on cybersecurity.

On the other hand, the WannaCry attack hit — and annoyed — many countries. Russia was among the hardest hit, and Britain among the most high-profile, and both have “some pretty good investigative capabilities,” Cattanach said.

Anick Jesdanun and Barbary Ortutay in New York, Lori Hinnant in Paris and Deb Riechmann in Washington contributed to this story.</s>NEW YORK, May 15 (Reuters) - Major cyber security firms Symantec Corp and Kaspersky Lab said on Monday they were looking into clues that may connect the global "ransomware" attack known as WannaCry with programs previously attributed to North Korea.

The two companies said some code in an earlier version of the WannaCry ransomware, which has encrypted data on hundreds of thousands of computers since Friday, and demanded users pay money to regain control of their machines, had also appeared in programs used by the Lazarus Group, which researchers from many companies said is run by North Korea.

The North Korean mission to the United Nations was not immediately available for comment. (Reporting by Joseph Menn and Michelle Nichols; Editing by Bill Rigby)</s>Well, isn’t this ironic? The NSA-derived Windows malware that shook the world over the weekend may be a North Korean creation, new revelations show. That’s right, the vulnerability that someone stole from the NSA may have been used to create a highly viral Windows virus that affected more than 300,000 computer systems in over 150 countries in a matter of days. And North Korea, the same country believed to have been behind the Sony hacked, could be responsible for the attack. It’s exactly the Sony hack that suggests the connection.

Security researchers discovered on Monday that the WannaCry malware was developed using the same code that was used in late 2014 to hack Sony, The Los Angeles Times reports.

“We believe this might hold the key to solve some of the mysteries around this attack,” Kaspersky Labs said after looking at a few lines of duplicated code discovered by a Google security researcher in an earlier version of WannaCry.

“While these findings do not indicate a definite link between Lazarus and WannaCry, we believe that there are sufficient connections to warrant further investigation,” security firm Symantec said.

The Lazarus Group is believed to be the hackers network that breached the Sony servers more than two years ago. The Times notes that the group has been connected to other attacks, dating back to at least 2009, including hits in South Korea, the US, Poland, and Bangladesh.

If the latter sounds familiar, that’s because recent reports linked North Korea to a huge bank heist last year that targeted the Bangladesh Bank. Then, hackers stole more than $80 million.

It’ll be interesting to see how Donald Trump reacts to this news, especially considering all of its moving pieces, and whether he’ll take any action against North Korea. If only Trump understood how the cyber works. After all, a 400-pound hacker may have been doing all of this from his bed.
The cybersecurity firms Kaspersky Lab and Symantec report that technical evidence connects the WannaCry ransomware attack to the North Korean-backed Lazarus Group. North Korea is also believed to be responsible for previous cyberattacks on the SWIFT banking system and against Sony Pictures.