Softpedia >News >Security
Softpedia Homepage   

North Korean Hackers from Lazarus May Be Behind WannaCry Ransomware Attack

Multiple security researchers have noticed the similarities

May 15, 2017 22:32 GMT  ·  By
WannaCry may have been born in North Korea
   WannaCry may have been born in North Korea

A new twist to the WannaCry story puts the authors of the ransomware in North Korea. 

Earlier today, a Google researcher by the name of Neel Mehta posted a message on Twitter featuring the hashtag #WannaCryptAttribution.  

The message also contains code samples, samples from the WannaCry cryptor sample from February 2017, and a Lazarus APT group sample from February 2015, folks from Kaspersky Lab point out. The commands presented in the tweet represent an encoding algorithm.

Lazarus is a rather well-known hacker group. They've been linked to the Sony Wiper attack, as well as the Bangladesh bank heist that left them a few millions short. The group has been active since 2011 and hundreds of samples have been collected over the years in regards to Lazarus. Mostly, it was revealed that they were creating malware, producing new samples via "multiple independent conveyors."

Lazarus or copy-cats?

There are, of course, plenty of questions about whether this is true or just a ruse. After all, it's not that difficult for the WannaCry authors to have copied Lazarus' code. On the other hand, the code appears to have not been removed from the 2015 backdoor code, which makes the story that much more believable.

Folks at Kaspersky are pretty certain that the WannaCry sample made available in February 2017 was actually compiled by the same people behind the current attack, or by people with access to the same source code.

Other security researchers besides Mehta have also noticed the same similarity, such as Comae Technologies' Matthieu Suiche, who also discovered and killed a new variant by activating the kill switch.  

Now, the interesting part is that Lazarus has been identified by US intelligence agencies as a North Korean government operation. Kaspersky Lab itself presented some evidence just a month or so ago, linking the attacks on Vietnamese banks, the Bangladeshi bank, as well as the SWIFT banking system, to Lazarus and North Korea.