‘Lazarus Group’ That Works On Behalf Of North Koreans May Be Behind WannaCry Ransomware Attack

PALLAVI SHARMA | 0
36
| May 16 , 2017 , 12:44 IST
[caption id="attachment_262179" align="aligncenter" width="700"]Representational Image Representational Image[/caption] As the world struggles to identify cybercriminals behind the global ransomware attack that hit 150 countries, an Indian-origin security researcher working with Google has claimed that the hackers may have links to North Korea. According to Neel Mehta's discovery, the "Lazarus Group" that works on behalf of North Koreans may be behind the attack as the hacking group has, in the past, used the same coding and tools as were used in "WannaCrypt" -- the software used in the current hacking into the Microsoft operating software, the BBC reported on Tuesday. ALSO READ: Ransomware Cyber Attacks Wreck Havoc Globally, India Escapes Major Damage "Neel Mehta's discovery is the most significant clue to date regarding the origins of WannaCrypt," the report quoted Moscow-based cyber security firm Kaspersky Lab as saying. "Lazarus Group", that according to Mehta is based in China, was responsible for a major hack on Sony Pictures in 2014 and another on a Bangladeshi bank in 2016. ALSO READ: Global Cyber Attack ‘Ransomware’ Costed The World USD 70,000 Kaspersky Lab, however, noted that a lot more information was needed about earlier versions of "WannaCrypt" before any firm conclusion could be reached. "We believe it's important that other researchers around the world investigate these similarities and attempt to discover more facts about the origin of 'WannaCrypt'," the cyber security company added. ALSO READ: Know It All: What Exactly Is ‘Ransomware’, How It Infects Your Computer & How You Can Prevent It! Though North Korea has never admitted any involvement in the Sony Pictures hack, security researchers and the US government are confident in the theory and neither can rule out the possibility of a false flag. There are possibilities that skilled hackers might have simply made the hack look like it had origins in North Korea by using similar techniques. ALSO READ: Massive Cyber-Attack: ‘Ransomware’ Wreaks Havoc Worldwide, Hits 99 Countries Kaspersky noted that false flags within "WannaCrypt" were "possible" but "improbable", as the shared code was removed from later versions. There is another possibility that "Lazarus Group" may be working independently and without the instructions from North Korea, the report added. Meanwhile, the White House said on Monday that less than $70,000 has been paid in the ransomware attack globally. "We are not aware of payments that have led to any data recovery," White House Homeland Security adviser Tom Bossert said at a daily briefing. Specially, no US federal systems are affected, he said.