N. Korean Hacker Group behind Crypto Thefts across 100 Countries

Tokyo, Sept. 18 (Jiji Press)--Japan's National Police Agency said Friday that a North Korean hacker group was behind a cyberattack spanning more than 100 countries, including Japan, that led to the theft of cryptocurrency worth about 1.7 billion yen.

The North Korean group, called WaterPlum, infected more than 30,000 devices with malware between December last year and July this year, stealing credentials for around 7,000 cryptocurrency accounts, according to a warning document released the same day.

Signed by seven organizations from four countries, including the NPA and the U.S. Federal Bureau of Investigation, the document was released under a framework called "public attribution," aimed at deterring cyberattacks by revealing groups or government agencies behind such attacks.

The NPA said that WaterPlum posed as corporate headhunters recruiting information technology professionals, sending malware-infected files disguised as technical assessments to steal victims' crypto-asset account credentials. At least 1.7 billion yen worth of cryptocurrency was transferred to accounts controlled by the group, with much of it believed to have come from compromised accounts.

The report also confirmed that North Korean IT workers living in North Korea, China and Russia earned foreign currency by taking on remote programming jobs and other work under false identities. As a result, hundreds of millions of yen had been transferred to North Korea in recent years.

[Copyright The Jiji Press, Ltd.]