Andariel, a hacking unit linked to North Korea, seized a server at a South Korean company in the summer of 2017. The group used it to mine roughly 70 Monero coins, worth about $25,000 as of the end of December, according to the leader of a hacking analysis team, Kwak Kyoung-ju, at the South Korean government-backed Financial Security Institute.
This report underscores North Korea’s increasing hacking capabilities, and appetite for cyber attacks that acquire cryptocurrencies which is fast becoming a source of income for Kim Jong Un’s regime. With sanctions cutting off oil supplies and other trade bans blocking the country’s traditional sources of income, North Korea has been accelerating its pursuit for digital cash.
“Andariel is going after anything that generates cash these days,” said Kwak. “Dust gathered over time builds a mountain.”
North Korean hackers may also have seized other computers to mine cryptocurrencies. Right now, they appear to be targeting Monero because of the currency’s focus on privacy and because it is easier to hide and launder than bitcoin, Kwak said. According to South Korean analysis, Andariel was able to seize control of the server undetected by its operator.
Like bitcoin, Monero uses a network of miners to verify its trades. However, it also mixes multiple transactions to make it more difficult to trace the origin of funds. It also has adopted “dual-key stealth” addresses that make it incredibly difficult to pinpoint recipients.
North Korean hackers have been increasing attacks on cryptocurrency exchanges in South Korea, FireEye—a security research firm—said in September.
The U.S. also placed blame for last spring’s WannaCry ransomeware attack on North Korean hackers. The attack impacted hundreds of thousands of computers globally and hackers demanded bitcoin in exchange for unlocking an infected computer’s files.
North Korean hackers’ shift to financial gain from gaining government secrets may accelerate this year as the UN steps up its efforts to squeeze the flow of funds used by the regime to fuel its nuclear arms development.