Speaking at the TNW Conference 2022, author and investigative journalist Geoff White addressed this perplexing contradiction. “The case of North Korea is unique in the world, and therefore its computer hackers are absolutely unique in the world as well,” he explained. The fact that most governments employ computer hackers isn’t news. They employ them to obtain advantageous information that they can use to advance their country’s position. As per White, North Korean hackers do something slightly different. They go after cash as well. That’s because North Korea is economically isolated from the rest of the world, as it’s subject to international financial sanctions. It needs to find alternative monetary resources. “So the accusation is it’s tasked its government hackers to go out and steal money for the regime,” White added. “Researchers call these hackers the Lazarus Group. To elaborate how the country’s government hackers get into bed with organized criminals, White provided the TNW audience with two examples of alleged North Korean cyberattacks. But I’ll tell you who is… organized criminals. And so North Korea’s hackers have started working with organized crime, which can provide the necessary networks.
1. Cosmos Co Op bank
Back in 2018, the Lazarus Group infiltrated the Indian bank through phishing emails sent to employees. Once inside the bank’s system, they navigated their way to the ATM payment system and manipulated every ATM withdrawal request that went into Cosmos Co Op bank. They took the details of 450 genuine legitimate account holders (account number, pin code, personal data, etc.), and they sent those details to their accomplices around the world. Then, they had their accomplices create fake cloned ATM cards for those accounts. That way, they made $11 million, withdrawn in 29 countries — within two hours and 13 minutes. The question here is who coordinated the attack, White noted.
2. The Bank of Valletta
The first cooperation of the Lazarus Group and Big Boss was so successful that in 2019 they attacked the Bank of Valletta in Malta. But how could he coordinate the attack in 29 different countries from Pyongyang, North Korea’s capital city? For that he needs accomplices and what’s the best place to look? The dark web, of course. There he found someone calling himself “Big Boss,” who turned out to have the necessary skill set. He can clone cards and also has a network of runners — money mules, who can go to the ATMs and make withdrawals.” Once again, they found their way into the bank through phishing emails. But this time the hackers didn’t do any ATM withdrawals. White’s theory is that they used SWIFT, seeking to bypass the previous challenge of somehow sending the cashed out money to North Korea. This time they stole $13 million. Luckily, Big Boss was arrested shortly after in the US for another criminal activity, which led to the arrest of HushPuppi as well in Dubai. They needed accounts that they could put the money in, and then launder it through. Luckily for the hackers, Big Boss had the perfect man for the job: “HushPuppi.” He had bank accounts around the world that can be used for money laundering. While both are sentenced to prison, Park Yin Hyok is yet to face justice. “For its part, North Korea says these allegations are a smear campaign by the US and that they have nothing to do with these computer hacking campaigns,” White explained. If you’re interested in finding out more about the activities of the Lazarus Group, you listen to Geoff White’s podcast The Lazarus Heist, or read his homonymous book.
