N. Korean Hacker Fingered For Wannacry Attacks

Park Jin Hyok, 34, is charged by US officials over 2017 WannaCry ransomware attack that affected more than 150 countries

The US justice department has charged an alleged North Korean spy for helping to perpetrate cyberattacks against the British National Health Service that saw operations cancelled, ambulances diverted and patient records made unavailable following a worldwide hack in 2017 which affected computers in more than 150 countries.

Park Jin Hyok, 34, was also involved in an attack against the Sony Corporation in 2014 and an $81m theft from the Bank of Bangladesh in 2016, a criminal complaint released on Thursday 6th Sept claimed.

It was not immediately clear if North Korea, which authorities said the operative was working on behalf of during the WannaCry cyber-attack, would make Park available to US law enforcement authorities.

Park was thought to have operated from China, but prosecutors said they now believe he is in North Korea.

US officials believe the hackers struck in retribution for The Interview, a Hollywood spoof film that lampooned the isolated nation to such an extent that its state media warned it would wage “merciless retaliation”. The 2017 attack, the largest to have ever hit the health service, hit computers at hospitals and GP surgeries across 48 NHS trusts.

At least 6,900 NHS appointments were cancelled, and up to 19,000 affected in total, after staff were forced to resort to using pen and paper when they were locked out of computerised systems. A subsequent government report found that NHS trusts had been left vulnerable because basic cybersecurity recommendations were not followed. None of 88 out of 236 trusts assessed by NHS Digital before the attack were found to have satisfied the necessary cybersecurity standards.

It had been reported that nearly all NHS trusts were using an obsolete version of Windows for which Microsoft had stopped providing security updates three years previously, while it was also suggested that 90% of trusts were using Windows XP, then a 15-year-old system. In the immediate aftermath of the hack the then-home secretary Amber Rudd was not able to confirm whether patient data had previously been backed up.

NHS workers at the time told the Guardian that the computers were affected after email attachments were opened, with the computers going down shortly after. Staff were swiftly told to “shut down, take out network cables and unplug the phones”, an NHS worker from an Essex hospital said.

The malware demanded ransoms of $300 (£230) in Bitcoin to users on the infected computers. Although there was no evidence any NHS organisation paid, according to NAO, the financial cost of the crippling episode remains unclear.
The National Crime Agency’s director general of operations paid tribute to the collaboration between UK and US law enforcement and warned that the distinction between nation states and criminal groups in cases of cybercrime has become increasingly blurred.

 “The ransomware attacks that affected the UK appear to be part of a series, and it’s right that they are prosecuted together to show the full scale of offending,” Steve Rodhouse said.

 “The WannaCry attack highlighted that cybercrime affects not just the country’s prosperity and security, but also affects our everyday way of life.

“The distinction between nation states and criminal groups in terms of cybercrime is becoming frequently more blurred and today’s charges are a significant step forward in our investigation.”

Home Office minister Ben Wallace said in October 2017 that the government was “as sure as possible” that North Korea was responsible for the attack. The US justice department confirmed that the WannaCry investigation, one of the most complex cybercriminal investigations it has ever conducted, is ongoing, and includes activity ranging through 2018. 

The December 2014 cyber-attack against Sony’s film-making studio saw five of its upcoming movies, including the big-budget musical remake Annie, released online to file-sharing sites by a group calling itself Guardians of Peace.

Amid threats to moviegoers, Sony cancelled the theatrical release of The Interview and instead released it online.
Bloomberg reported that a Sony internal report linked the attack to a group associated with Pyongyang known as DarkSeoul, which wiped out the computers of South Korean banks and broadcasters in March 2013.

A North Korean official denied the country was responsible for cyber-attacks on Sony in an interview with Voice of America.

“Linking the DPRK to the Sony hacking is another fabrication targeting the country,” said the unidentified diplomat. “My country publicly declared that it would follow international norms banning hacking and piracy.”

Guardian:

You Might Also Read: 

Healthcare Cyber-Attacks Still Going Up:

Preventing Another Wannacry:
 

« The App That Lets You Sell Your Personal Healthcare Data
British Airways Faces £Multimillion Fine »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Cyber Data-Risk Managers

Cyber Data-Risk Managers

Cyber Data-Risk Managers Pty Ltd is an insurance broker based in Melbourne, Australia specializing in Cyber insurance / Data breach insurance.

Core Security

Core Security

Core Security provides threat-aware identity, access, authentication and vulnerability management solutions.

Computer Forensic Services

Computer Forensic Services

Computer Forensic Services are digital evidence specialists. Practice areas include Information Security, e-Discovery, Law Enforcement Support and Litigation.

Maticmind

Maticmind

Maticmind is an ICT System Integrator providing solutions and specialized skills in Networking, Security, Unified Communications & Collaboration, Datacenter & Cloud and Application.

CybExer Technologies

CybExer Technologies

CybExer provide an on-premise, easily deployable solution for complex technical cyber security exercises based on experience in military grade ranges.

ADL Process

ADL Process

ADL Process offer secure data destruction, certified product destruction and responsible electronics recycling services to businesses and institutions.

Cowbell Cyber

Cowbell Cyber

Cowbell Cyber™ offers continuous risk assessment, comprehensive cyber liability coverage, and continuous underwriting through an AI-powered platform.

Bace Cybersecurity Institute (BCI)

Bace Cybersecurity Institute (BCI)

Bace Cybersecurity Institute focuses on understanding, empowering and taking action across four critical areas driving continual improvement toward a safer, more secure cyber world.

Bugraptors

Bugraptors

BugRaptors is a certified software testing company with extensive experience as a third-party testing vendor, effectively proven as a leader in software testing & QA Services.

CyberGuard Technologies

CyberGuard Technologies

CyberGuard Technologies provides a suite of fully managed end-to-end security services from its 24/7 UK security operations centre.

Aite-Novarica Group

Aite-Novarica Group

Aite-Novarica's Cybersecurity practice provides ongoing research and advisory services to chief information security officers focused on protecting their companies’ assets.

AnyTech365

AnyTech365

AnyTech365 is a leading European IT Security and Support company helping end users and small businesses have a worry-free experience with all things tech.

Bit Sentinel

Bit Sentinel

Bit Sentinel is an information security company. We help companies like yours discover, prioritize, and effectively remediate potential cybersecurity risks.

Codezero Technologies

Codezero Technologies

Codezero is at the forefront of microservices development, employing an identity-aware overlay network that delivers zero-trust security to DevOps.

Pixee

Pixee

Pixee fixes vulnerabilities, hardens code, squashes bugs, and gives engineers more time to focus on the work that counts.

Anthropic

Anthropic

Anthropic is a Public Benefit Corporation, whose purpose is the responsible development and maintenance of advanced AI for the long-term benefit of humanity.