3,000 North Korean hackers pillaging online wallets
North Korean hackers are attacking financial institutions in a bid to steal funds, according to a South Korean institute backed by the government. North Korean defectors have described an official state-sponsored force of around 3,000 hackers trained in China and Russia that is targeting virtual currency service providers. The group's focus has changed from uncovering government secrets and disrupting the social order to acquisition of funds. North Korean hackers were responsible for the $81m theft from the Bangladeshi central bank in 2016.
SEOUL • North Korea's state-sponsored hackers are increasingly going after money rather than secrets, according to a report by a South Korean government- backed institute.

Formerly, most such attacks appeared intended to cause social disruption or purloin secret data, and the targets were generally the computer networks of government agencies or media companies in countries it saw as hostile.

The best-known example was a 2014 attack on computers at Sony Pictures Entertainment.

That kind of attack is still occurring, but in the past few years, North Korean hackers seem to have become more interested in cash, the Financial Security Institute said in its report on Thursday.

It said North Korean-linked hackers were behind the digital theft of US$81 million (S$110 million) from Bangladesh's central bank last year. The North Koreans also tried to breach Polish banks, leaving traces that led anti-hacking experts to believe the hacking group also planned to steal money from more than 100 other organisations around the world.

North Korea is isolated, impoverished and desperately short of foreign currency to pay for imports. Even so, it has trained a large army of hackers, originally as an inexpensive means of espionage, sabotage and propaganda, but now also as a moneymaker.

Russian cyber security firm Kaspersky Lab has identified a hacking group called Bluenoroff that it says is to blame for attacks on foreign financial institutions, like those in Poland and Bangladesh. Bluenoroff is said to be an offshoot of Lazarus, the North Korea-linked hacking group implicated in earlier hits.