North Korea’s Unit 180 Behind Cyberattacks?

What might lie behind the cyberattacks emanating from North Korea? Possibly Unit 180, which Reuters reports is a “special cell” within the country’s main spy agency.

In addition, reports the newswire, cyber industry observers and researchers have said that they have found “technical evidence” that links North Korea with this month’s WannaCry wave of cyberattacks, which hit 300,000 computers in 150 nations.

North Korea has rejected that claim, said Reuters. The country has yet to be targeted by any formal allegations or criminal charges, but it has been tied to a hacking group, Lazarus, which may be the force behind last year’s $81 million cyber heist that took money out of Bangladesh’s central bank accounts and also caused chaos at Sony’s Hollywood operations.

One source noted by Reuters, former computer science Professor Kim Heung-kwang, who defected to South Korea from North Korea 13 years ago, has said the attacks were carried out by Unit 180, housed within Reconnaissance General Bureau, North Korea’s overseas intelligence arm.

“Unit 180 is engaged in hacking financial institutions (by) breaching and withdrawing money out of bank accounts,” Kim told the wire. “The hackers go overseas to find somewhere with better internet services than North Korea so as not to leave a trace” and have posted as trading firm employees or joint ventures in China or elsewhere in Asia.

Separately, South Korean officials have noted evidence of the attacks, their origin and methodologies, all pointing toward the North. “North Korea is carrying out cyber-attacks through third countries to cover up the origin of the attacks and using their information and communication technology infrastructure,” Ahn Chong-ghee, South Korea’s vice foreign minister, said in written comments given to Reuters. Other sources said Malaysia has been a point from which attacks have been carried out.