Signs of North Korea Link in Japanese IT Firm Hack... "Five IP Addresses Match"

Large-Scale Hacking of GMO Internet Group
Hackers Demand $1 Million

North Korea-linked hackers may have been involved in a cyberattack targeting Japanese IT giant GMO Internet Group. Evidence found on a website used by the hackers matched IP addresses previously used by North Korean hacker groups, lending weight to suspicions that North Korea was behind the attack.

Kyodo News reported exclusively on November 2 that, after analyzing a recent hacking incident, GMO Internet Group concluded that a North Korea-linked hacker group was likely involved. The company reached this conclusion based on characteristics of the malware and communication records left during the attack, and also reported its findings to the Japanese government, Kyodo News said.

Investigators also found evidence pointing to a connection with North Korean hacker groups. Kyodo News, working with security experts, analyzed a website set up by the hackers to claim responsibility for the attack. Of the IP addresses that accessed the site shortly after it went live, five matched addresses previously used by North Korean hacker groups.

However, it remains difficult to conclusively attribute the attack to North Korea based on this evidence. The website set up by the hackers to claim responsibility was hosted on servers belonging to a U.S. company, while files posted on the site were found to have been created with Chinese software. Some of the programs that collected visitor information also contained Japanese. Security experts said the attackers may have deliberately left traces pointing to multiple countries to complicate efforts to track them.

On October 20, GMO Internet Group discovered malware on some servers used for its cloud service for automated foreign exchange (FX) trading. The company subsequently found signs that customers' financial account login details and other information had been leaked externally, and that unauthorized transactions may have been made in some accounts.

The hackers claim to have infiltrated 27,000 servers and personal computers and stolen user information. They are demanding $1 million (1.339 billion won) in exchange for the data. The company announced that it would not meet the hackers' demands and would instead offer a $1 million reward. The reward is intended for anyone who provides information that helps identify the attackers or determine the full circumstances of the incident.

This content was produced with the assistance of AI translation services.