【Foreign Archives】

Source：Exquisite Information Network Editor：Social Good Time：2025-06-26 12:35:53

The Foreign Archivesransomware attack that held thousands of computers hostage late last week might be linked to a hacker group with ties to North Korea, researchers have found.

On Monday, Google security researcher Neel Mehta posted a cryptic set of characters on Twitter together with the hashtag #WannaCryptAttribution. Kaspersky Lab researchers then explained that Mehta has posted two similar code samples, one from an early version of WannaCry, and one originating from Lazarus, a hacker group which possibly originates from North Korea.

SEE ALSO: It's time to take your medicine and stop WannaCry ransomware in its tracks

According to Ars Technica, what Mehta has found is evidence that a February variant of WannaCry shares code with the 2015 version of Cantopee, a backdoor used by Lazarus Group. Furthermore, the fact that WannaCry's code contains a kill switch -- a way to stop the malware from spreading -- indicates that whoever is behind the attack is not (purely) financially motivated.

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

9c7c7149387a1c79679a87dd1ba755bc @ 0x402560, 0x40F598
ac21c8ad899727137c4b94458d7aa8d8 @ 0x10004ba0, 0x10012AA4#WannaCryptAttribution
— Neel Mehta (@neelmehta) May 15, 2017

It's possible that someone is impersonating the group, though Kaspersky claims this is "improbable."

Kaspersky took a good look into the Lazarus Group's activities and posted its findings in April 2017. The group appears to be highly sophisticated and very active; in a blog post, Kaspersky called the scale of the group's operation "shocking."

The evidence tying Lazarus to North Korea, however, is slim, and includes some traces of group's activity originating from the country, as well as a list of targets that includes Sony Pictures (remember The Interview?) and South Korea.

Nothing is certain at this point, and more research will be needed before WannaCry's makers are unmasked. Kaspersky does, however, claim that "Neel Mehta’s discovery is the most significant clue to date regarding the origins of Wannacry."

Featured Video For You

Chimp smokes a pack of cigarettes a day at North Korean zoo

Topics Cybersecurity

Previous：President Trump says semiconductor tariffs are next

Next：Apple is reportedly still working on smart glasses of some kind

【Foreign Archives】

Related Articles

Related Recommendations

Categories

Latest Articles

Popular Articles

Hot Recommendations

Featured Column

Quick Links

Quick Links