US charges 3 North Korean hackers in $1.3 billion theft scheme

The charges also include allegations of conspiring to create and deploy multiple malicious cryptocurrency applications, and to develop and fraudulently market a blockchain platform

San Francisco: The US has accused three North Korean hackers of conspiring to steal and extort more than $1.3 billion of money and cryptocurrency from financial institutions and companies.

The charges also include allegations of conspiring to create and deploy multiple malicious cryptocurrency applications, and to develop and fraudulently market a blockchain platform, according to the indictment unsealed by the US Department of Justice (DOJ) on Wednesday.

---

The indictment alleges a broad array of criminal cyber activities undertaken by the conspiracy, in the US and abroad, for revenge or financial gain.

The schemes alleged include cyberattack on Sony Pictures Entertainment in November 2014 in retaliation for “The Interview,” a movie that depicted a fictional assassination of the North Korean leader.

“North Korea’s operatives, using keyboards rather than guns, stealing digital wallets of cryptocurrency instead of sacks of cash, are the world’s leading bank robbers,” Assistant Attorney General John Demers of the US Justice Department’s National Security Division, said in a statement.

The indictment expands the 2018 case that detailed attack on Sony Pictures and creation of WannaCry ransomware.

“The conduct detailed in the indictment are the acts of a criminal nation-state that has stopped at nothing to extract revenge and obtain money to prop up its regime,” said Acting US Attorney Tracy Wilkison for the Central District of California.

The hacking indictment filed in the US District Court in Los Angeles alleges that Jon Chang Hyok, Kim Il, and Park Jin Hyok were members of units of the Reconnaissance General Bureau (RGB), a military intelligence agency of North Korea, which engaged in criminal hacking.

These North Korean military hacking units are known by multiple names in the cybersecurity community, including Lazarus Group and Advanced Persistent Threat 38 (APT38).

Park was previously charged in a criminal complaint unsealed in September 2018.