| –MAKING SENSE OF NORTH KOREA: The computer code from the Wanna Cry ransomware appears to copy large swaths from malware written by The Lazarus Group, a group tied to North Korea.
–…DOES THAT MEAN ANYTHING? That’s hard to say. The overlapping code only appears in early drafts of Wanna Cry released in February. Kaspersky Lab noted that the matching code was removed from later versions of the ransomware, which they believe would be unlikely if it had been intended to throw researchers off the scent of the real criminals. “We believe a theory a false flag although possible, is improbable,” Kaspersky Lab explained in a blog post. Meanwhile, Symantec found tools used by Lazarus imbedded on some of the first computers to be infected by Wanna Cry – a version that predated its use of NSA-linked tools to propagate the ransomware. Symantec hints this may mean that Lazarus tools were the original method used to spread the ransomware. And Simon Choi, a South Korean researcher at Hauri Inc., says that he’s come across North Korean hackers looking to build ransomware in the past.
–…ON THE OTHER HAND: Neither Symantec nor Kasperky consider the ties conclusive. There are other reasons hackers copy code than trying to frame another actor. Hackers copy other people’s code for the sake of convenience, too. And, if Wanna Cry was North Korean, the country made a curious mistake in the design of the ransomware.
–…NOT DESIGNED TO ACCEPT MONEY: Lazarus Group is most widely known for hacking Sony Pictures in protest of the movie “The Interview.” But the group’s most impactful hacking has been to generate revenue. Lazarus has been fingered in a string of digital bank robberies conducted by hacking one bank and requesting massive cash transfers from another over the SWIFT banking transactions system that financial institutions use to move money. It stole $81 million from the central bank of Bangladesh alone. Choi notes that North Korea has also deployed bitcoin mining malware in the past. The hacking is believed to provide a revenue stream for the Hermit Nation that circumvents crippling international sanctions. If that is the case, a strange architectural decision in Wanna Cry seems even stranger. The ransomware encrypts files until a user pays to have the files released. But Wanna Cry does not have an automated system to release the files. After payment, Wanna Cry requires a human to authorize decryption, which drastically limits the amount of money they get.
–…STILL UNEXPLAINED: For the amount of damage the ransomware has caused, it has earned very little money. Bitcoin makes it difficult to trace an account to its owner but allows anyone to view the contents and transactions of any account. The daily revenue of Wanna Cry is visible to the public. And Wanna Cry is on pace to average $15,000 a day in revenue over its first five days. By comparison, CryptoWall ransomware earned nearly a million dollars a day in 2015. Some ransomware makers hire customer support centers to help victims make payments using bitcoin, which some users find confusing. $15,000 is an extremely low total for such a prolific product. It is unclear why it has struggled to work.
–…MEANWHILE, THE SHADOW BROKERS RESURFACED: The group that released the likely NSA-designed hacking tool used in the international “Wanna Cry” ransomware attack announced a monthly subscription service Tuesday for its remaining cache of stolen documents. The anonymous Shadow Brokers, who have been periodically releasing source code and documents believed to have been stolen from the National Security Agency since the summer, announced the new monetization scheme in a post early Tuesday morning. The message was written in broken English typical of the group. “Is being like wine of month club. Each month peoples can be paying membership fee, then getting members only data dump each month. What members doing with data after is up to members,” the Brokers wrote.
To read the rest of our piece, click here.
–…MEET THE EVEN BIGGER MALWARE LIKELY USING NSA-LEAKED HACKING TOOLS: Researchers at Proofpoint discovered new malware when they deliberately tried to get a machine infected with Wanna Cry. But instead of Wanna Cry, something else moved in instead. The malware they have named Adylkuzz is designed to co-opt computers to mine a cryptocurrency named Monero designed to be even more secretive than bitcoin. Adylkuzz uses the same alleged NSA-designed hacking tool as Wanna Cry, called EternalBlue, and a second tool taken from the same NSA leak, called DoublePulsar. Proofpoint calculates that it infects hundreds of thousands of systems and “may be larger in scale than Wanna Cry.” It also predates Wanna Cry by a number of weeks. |
