Kyodo News reported, citing sources close to the matter, that GMO Internet Group’s analysis points to a North Korea-linked group as likely behind an October attack involving leaked foreign-exchange customer data used in fraud.
GMO said last week that information tied to its foreign-exchange trading service was leaked without authorization and used in fraudulent transactions. Kyodo News reported that some customer information was published Oct. 27 after a hacker threatened to disclose customer records and carry out a ransomware attack.
Kyodo News reported that people close to the matter said GMO’s assessment considered the malware involved and other evidence left by those responsible. They said the company appeared to have notified the Japanese government.
Kyodo News, working with security experts, found five IP addresses that visited the attack-claim website soon after it launched matched addresses previously associated with a North Korean hacking group. Cybersecurity sources told Kyodo News that the site included traces linked to several countries, including the United States and Japan. They said those clues may have been intended to misdirect investigators.
A separate review by security experts dated Oct. 31 found similarities in the design and some source code of a victim information-sharing forum and the site claiming responsibility for the attack. The experts said the forum may have been set up by the attacker and may have been intended to gather information from victims.
Separately, GMO GlobalSign K.K., the group’s authentication subsidiary, said personal information belonging to at least 45,000 people at client companies leaked through its employee ID management service. EconoTimes previously covered GMO’s $1 million tip program after a leak-site domain was suspended.
Kyodo News reported, citing people close to the matter, that GMO appeared to have notified the Japanese government and would now focus on determining the full circumstances.
