Japanese IT giant GMO Internet Group has reported to the Japanese government that a North Korea-linked hacker group is likely behind an unauthorized intrusion into its cloud service, Kyodo News reported Sunday.

The incident involved "Onamae.com Desktop Cloud," GMO's cloud service used for automated foreign exchange margin trading.

GMO confirmed on Oct. 20 that malware had been installed on some customer servers and suspended the service the following day. As many as 26,739 servers may have been affected. Login credentials for trading accounts are believed to have been leaked, and some customers reported unauthorized financial transactions made without their knowledge.

GMO analyzed the characteristics of the malware and other traces left by the attackers and concluded that a North Korea-linked group was likely involved. Kyodo News, working with security experts, analyzed a website where the hackers disclosed details of the attack and found that five IP addresses that accessed the site shortly after it went live matched addresses previously used by North Korean hacker groups.

North Korean leader Kim Jong-un presides over the Third Company Commanders' Conference of the Korean People's Army in Pyongyang on Oct. 22 and 23, delivering a speech on "building a powerful army in the new era and the mission of company commanders." [KCNA]
North Korean leader Kim Jong-un presides over the Third Company Commanders' Conference of the Korean People's Army in Pyongyang on Oct. 22 and 23, delivering a speech on "building a powerful army in the new era and the mission of company commanders." [KCNA]

GMO Internet Group said it would not comply with any ransom demands from the attackers. Instead, the company announced Wednesday that it would offer a total of $1 million in reward money to anyone who provides information leading to the arrest of the perpetrators or helps clarify the circumstances of the attack.

Affected customers will receive a consolation payment of 5,000 yen ($32), while customers whose personal information is confirmed to have been exposed will receive a separate special consolation payment of up to 3 million yen.

GMO Internet Group Chairman and President Kumagai Masatoshi is scheduled to hold a press conference Monday to explain the sequence of events and the findings of the company's investigation, according to Kyodo News.

Suspected large-scale hacking operations by North Korea-linked groups have been mounting in recent weeks.

On Thursday, approximately $6.3 billion in virtual assets was stolen from Binance, the world's largest cryptocurrency exchange. The FBI identified the North Korea-linked hacking group "TraderTraitor" as responsible for the attack on Saturday.

According to an analysis Microsoft published Thursday, North Korea-linked groups have been using AI to research potential targets and generate fake resumes and anticipated interview responses. Materials needed to assume false identities have also been produced with the help of AI, the analysis found.

AI has not yet reached the stage of carrying out hacking operations autonomously, but it is helping attackers reach more individuals and organizations in less time, Microsoft said.

South Korean police have also recently begun investigating suspected cases of North Korean IT workers infiltrating domestic companies under false identities — a separate threat from data theft through hacking, in which operatives attempt to gain access to internal corporate systems by misrepresenting who they are.

The scale of the attacks is also growing. According to blockchain analytics firm Chainalysis, approximately 60 percent of all virtual assets stolen through hacking worldwide last year — about $2 billion — were attributed to North Korea-linked groups.


why37@heraldcorp.com