The WannaCry ransomware might have a link to North Korea

An earlier version of WannaCry shared code with a hacking tool used by the Lazarus Group, according to security researchers

As security researchers investigate last Friday’s massive attack from the WannaCry ransomware, they’ve noticed clues that may link it with a North Korean hacking group that has been blamed for attacking banks across the world.

The evidence is far from a smoking gun, and may prove inconclusive. But security researchers have noticed a similarity between an earlier version of WannaCry and a hacking tool used by the Lazarus Group.

Both the 2014 Sony Hack and a string of recent banking heists have been tied to the group, which security researchers suspect works for North Korea.

Apparently, a variant of WannaCry found in February shared some computer code with a hacking tool the Lazarus group used in 2015.

Google researcher Neel Mehta noticed the similarity on Monday, which was confirmed by other experts including those at security firm Kaspersky Lab.

“For now, more research is required into older versions of Wannacry,” Kaspersky Lab said in a blog post. “We believe this might hold the key to solve some of the mysteries around this attack.”

On Monday, security firm Symantec also reported finding clues that may link WannaCry with the shadowy group. It’s found earlier versions of the ransomware on machines that have been compromised by hacking tools used by Lazarus, according to Vikram Thakur, technical director at the company.

“Shortly after these tools were found on these machines, we could see WannaCry files showing up,” he said.

However, all of these WannaCry samples are earlier variants and different from the one that struck on Friday and infected Windows systems across the world.

Symantec is investigating whether the newer WannaCry samples also share any code overlap with the Lazarus Group’s hacking tools, Thakur said.

But even if they do, it’s still possible a separate hacker may have stolen snippets of code from past malware associated with the shadowy group.

Once hacking tools are used, they often leak on the internet, meaning anyone can use them, according to security experts. Thakur said Symantec is investigating how prevalent this shared code is.

If it’s in wide-use, then the likelihood Lazarus was involved with WannaCry will shrink, he said.

The machines Symantec found infected with both the Lazarus tools and WannaCry may have also been infected with other forms of malware, Thakur said. If so, that would suggest different hackers had targeted the same system, making the evidence more circumstantial.

“I think it’s a little early in our analysis to conclude anything,” he said.

Nevertheless, governments across the world are investigating who was behind Friday’s ransomware attack.

“Attribution can be difficult here,” said U.S. homeland security advisor Tom Bossert in a Monday press briefing. “I don’t want to say we have no clues… the best and brightest are working on that.”

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Michael Kan

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?