North Korea-linked hacking group likely behind GMO cyberattack: sources

An analysis by GMO Internet Group Inc. suggests a North Korea-associated hacking group was likely responsible for a cyberattack on the company last month. Sources familiar with the matter say this conclusion was reached based on malware characteristics and other traces left by the attackers. The company has reportedly notified the government and is now investigating the full details.

Security experts, working with Kyodo News, discovered that five IP addresses used to access a website claiming responsibility for the attack matched those previously associated with a North Korean hacking group. The website contained traces linked to multiple nations, including the U.S. and Japan, which may indicate an attempt to mislead investigators through a false flag operation, according to cybersecurity sources.

Further analysis revealed the website's domain was registered from a U.S. company on September 1 and its hosting server was provided by the same entity. The operating system was set to English, and a portion of the program used to gather visitor logs contained Japanese text, hinting at AI generation. Files on the site were created using software commonly developed in China.

A victim information sharing forum website, designed to facilitate communication among attack victims, may have been established by the hacker, as its web structure bears substantial similarities to the claimant website, cybersecurity experts noted. The registration of this website occurred two days prior to the company's public announcement of the cyberattack.

Both websites share an identical overall design and source code, making them nearly indistinguishable, one expert explained. Last week, GMO confirmed unauthorized disclosure of customer information related to its foreign exchange trading service, which was subsequently used in fraudulent transactions. The hacker threatened to expose customer data and launch a ransomware attack.

GMO did not respond to the request, and some customer data was leaked on October 22. One victim reported receiving multiple emails from the attacker, using a Russian-sounding name, on the night of October 22. Additionally, GMO's GlobalSign K.K. subsidiary disclosed that personal information of at least 45,000 individuals at client companies was compromised through its employee ID management service.