North Korea’s Unit 180: The Cyber Warfare Cell Worrying The West
According to sources, the North Korean cyber attacks are being carried out by hackers from overseas.
advertisement
North Korea’s main spy agency has a special cell called Unit 180 that is likely to have launched some of its most daring and successful cyber attacks, according to defectors, officials and internet security experts.
North Korea has been blamed in recent years for a series of online attacks, mostly on financial networks in the United States, South Korea and over a dozen other countries.
Cyber security researchers have also said they have found technical evidence that could link North Korea with the global WannaCry “ransomware” cyber attack that infected more than 300,000 computers in 150 countries this month. Pyongyang has called the allegations “ridiculous”.
The crux of the allegations against North Korea is its connection to a hacking group called Lazarus that is linked to last year's 81 million dollar cyber heist at the Bangladesh central bank and the 2014 attack on Sony's Hollywood studio. The US government has blamed North Korea for the Sony hack and some US officials have said prosecutors are building a case against Pyongyang in the Bangladesh Bank theft.
No conclusive proof has been provided and no criminal charges have yet been filed. North Korea has also denied being behind the Sony and banking attacks.
Hacking From Overseas
Kim Heung-kwang, a former computer science professor in North Korea who defected to the South in 2004 and still has sources inside North Korea, said Pyongyang's cyber attacks aimed at raising cash are likely organised by Unit 180, a part of the Reconnaissance General Bureau (RGB), its main overseas intelligence agency.
“Unit 180 is engaged in hacking financial institutions (by) breaching and withdrawing money out of bank accounts," Kim told Reuters. He has previously said that some of his former students have joined North Korea's Strategic Cyber Command, its cyber-army.
He said it was likely they went under the cover of being employees of trading firms, overseas branches of North Korean companies, or joint ventures in China or Southeast Asia.
James Lewis, a North Korea expert at the Washington-based Center for Strategic and International Studies, said Pyongyang first used hacking as a tool for espionage and then political harassment against South Korean and US targets.
“They changed after Sony by using hacking to support criminal activities to generate hard currency for the regime,” he said.
“So far, it's worked as well as or better than drugs, counterfeiting, smuggling – all their usual tricks,” Lewis said.
Cost-Effective, Deniable
The US Department of Defense said in a report submitted to Congress last year that North Korea likely “views cyber warfare as a cost-effective, asymmetric, deniable tool that it can employ with little risk from reprisal attacks, in part because its networks are largely separated from the Internet”.
“It is likely to use Internet infrastructure from third-party nations,” the report said.
South Korean officials say they have considerable evidence of North Korea's cyber warfare operations.
“North Korea is carrying out cyber attacks through third countries to cover up the origin of the attacks and using their information and communication technology infrastructure," Ahn Chong-ghee, South Korea's vice foreign minister, told Reuters in written comments.
Besides the Bangladesh Bank heist, he said Pyongyang was also suspected in attacks on banks in the Philippines, Vietnam and Poland.
North Korea was also suspected of staging cyber attacks against the South Korean nuclear reactor operator in 2014, although it denied any involvement.
That attack was conducted from a base in China, according to Simon Choi, a senior security researcher at Seoul-based anti-virus company Hauri Inc.
“They operate there so that regardless of what kind of project they do, they have Chinese IP addresses,” said Choi, who has conducted extensive research into North Korea's hacking capabilities.
‘A Threat to US Private or Govt Networks’
Michael Madden, a US-based expert on the North Korean leadership, said Unit 180 was one of many elite cyber warfare groups in the North Korean intelligence community.
“The personnel are recruited from senior middle schools and receive advanced training at some elite training institutions,” Madden told Reuters.
“They have a certain amount of autonomy in their missions and tasking as well,” he said, adding that they could be operating from hotels in China or Eastern Europe.
In the United States, officials said there was no conclusive evidence that North Korea was behind the WannaCry ransomware, but that was no reason to be complacent.
“Whether or not they are directly involved with ransomware doesn't change the fact that they are a real cyber threat,” said a senior administration official, who spoke on condition of anonymity.
Dmitri Alperovitch, co-founder of prominent US security firm CrowdStrike Inc, added: “Their capabilities have improved steadily over time, and we consider them to be a threat actor that is capable of inflicting significant damage on US private or government networks.”
(This article was published in an arrangement with Reuters. The article has been edited for length.)
(At The Quint, we question everything. Play an active role in shaping our journalism by becoming a member today.)