U.S. Blames North Korea for Hacking Spree, Says More Attacks Likely

The U.S. government Tuesday issued a rare alert squarely blaming the North Korean government for a raft of cyberattacks stretching back to 2009 and warning that more were likely.

The joint alert from the U.S. Department of Homeland Security and the Federal Bureau of Investigation said that “cyber actors of the North Korean government,” referred to in the report as “Hidden Cobra,” had targeted the media, aerospace and financial sectors, as well as critical infrastructure, in the United States and globally.

The new level of detail about the U.S. government’s analysis of suspected North Korean hacking activity comes as tensions continue to escalate between Washington and the reclusive country due to Pyongyang’s continued missile testing. The alert warned that North Korea would continue to rely on cyber operations to advance its military and strategic objectives.

North Korea has routinely denied involvement in cyberattacks against other countries.

The North Korean mission to the United Nations was not immediately available for comment.

Tuesday’s alert said Hidden Cobra has been previously referred to by private sector experts as Lazarus Group and Guardians of the Peace, which have been linked to attacks such as the 2014 intrusion into Sony Corp.’s Sony Pictures Entertainment.

Symantec Corp. and Kaspersky Lab both said last month it was “highly likely” that Lazarus was behind the WannaCry ransomware attack that infected more than 300,000 computers worldwide, disrupting operations at hospitals, banks and schools.

The alert did not identify specific Hidden Cobra victims. It said the group had compromised a range of victims and that some intrusions had resulted in thefts of data while others were disruptive. The group’s capabilities include denial of service attacks, which send reams of junk traffic to a server to knock it offline, keyloggers, remote access tools and several variants of malware, the alert said.

John Hultquist, a cyberintelligence analyst with FireEye Inc., said his firm was concerned about increasingly aggressive cyberattacks from North Korea.

The hacks include cyberespionage at South Korean finance, energy and transportation firms that appears to be reconnaissance ahead of other attacks that would be disruptive or destructive, he said.

“It suggests they are preparing for something fairly significant,” he added.

Hidden Cobra commonly targets systems that run older versions of Microsoft Corp. operating systems that are no longer patched, the alert said, and also used Adobe Flash player vulnerabilities to gain access into targeted computers.

The report urged organizations to upgrade their systems and to halt use of Adobe Flash and Microsoft Silverlight when possible.

Microsoft and Adobe Systems Inc. did not immediately respond to requests for comment.

North Korean hacking activity has grown increasingly hostile in recent years, according to Western officials and cybersecurity experts.

“The U.S. government seeks to arm network defenders with the tools they need to identify, detect and disrupt North Korean government malicious cyberactivity that is targeting our country’s and our allies’ networks,” a DHS official said about the alert. The official was not authorized to speak publicly.