The Treasury Department announced sanctions Sept. 13 against the North Korean-sponsored hacking group involved in the 2017 WannaCry ransomware attacks that shutdown over 300,000 computers across 150 countries.<\/p>\n\n\n\n
The announcement from the Treasury\u2019s Office of Foreign Assets Control specifically targets the hacking group Lazarus Group and two subsidiaries, which the U.S. government says are backed by North Korea\u2019s primary intelligence agency and help fund the country\u2019s illicit weapons program.<\/p>\n\n\n\n
\u201cTreasury is taking action against North Korean hacking groups that have been perpetrating cyber attacks to support illicit weapon and missile programs,\u201d said Sigal Mandelker, the department\u2019s under secretary for terrorism and financial intelligence. \u201cWe will continue to enforce existing U.S. and U.N. sanctions against North Korea and work with the international community to improve cybersecurity of financial networks.\u201d<\/p>\n\n\n\n
The sanctions block citizens and residents of the United States from doing business with any of the named entities, as well as blocks the groups from accessing any property in the United States. In addition, foreign financial institutions cannot facilitate transactions with the group.<\/p>\n\n\n\n
Lazarus Group has targeted government institutions and private businesses across the globe and is known for its involvement in the WannaCry ransomware attacks. It is also responsible for the 2014 cyberattacks on Sony, Treasury said. That cyberattack delayed the release of the movie, \u201cThe Interview,\u201d which poked fun of Kim Jong-un.<\/p>\n\n\n\n
The sanctions extended to subsidiaries of Lazarus Group: Bluenoroff and Andariel.<\/p>\n\n\n\n
According to the Treasury Department, Bluenoroff is known to attack financial institutions to steal money for the country\u2019s nuclear weapons and ballistic missile program. It has stolen over $1.1 billion from financial institutions across the globe, typically using phishing attacks and backdoor intrusion. It is also known to conduct raids against cryptocurrency exchanges. In what the Treasury described as one of the group\u2019s \u201cmost notorious\u201d attacks, the group stole $80 million from the Central Bank of Bangladesh\u2019s New York Federal Reserve account.<\/p>\n\n\n\n
\u201cThis is yet another indication of how forward-leaning U.S. government\u2019s position has become in a relatively short period of time on doing attribution of malevolent cyber actors,” said Dmitri Alperovitch, CTO and co-founder of CrowdStrike, a threat intelligence company. \u201cA few years ago, this type of action would have been unprecedented. Today it is routine.\u201d<\/p>\n\n\n\n
Andariel, another subsidiary of Lazarus Group, has continually targeted cyber activity against the South Korean government and military to collect intelligence, according to the department. The group once entered the South Korean Defense Ministry\u2019s intranet. Aside from activities targeting government, Andariel conducts cyberattacks against banks and private industry. The group had been caught hacking into ATMs to sell bank card and account information on the black market, Treasury said.<\/p>\n\n\n\n
Between January 2017 and September 2018, the three groups \u201clikely\u201d stole $571 million on cryptocurrency from five Asian exchanges, according to the department.<\/p>\n\n\n\n
\u201cAttribution of these incidents is quite clear and points directly to the Kim regime,\u201d said Rep. Jim Langevin, D-R.I. and chairman of the House Armed Services subcommittee on Intelligence and Emerging Threats and Capabilities, in a statement. \u201cResponsible nations do not engage in this kind of destabilizing behavior, and we must take action to hold irresponsible states accountable. Malicious cyber actors around the world need to know that they cannot act with impunity and that the United States will use all instruments of national power to counter their activity.\u201d<\/p>\n\n\n\n
Earlier in September, U.S. Cyber Command shared 11 samples of Lazarus Group malware on its VirusTotal site.<\/p>\n","protected":false},"excerpt":{"rendered":"
North Korean hacking groups have attacked financial institutions to raise money for the country’s nuclear program.<\/p>\n","protected":false},"author":7,"featured_media":30482,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"9":{"categories":["home","daily-brief","newsletters"],"primary_category":""}}},"categories":[1],"tags":[],"coauthors":[3242],"class_list":["post-10183","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"acf":{"subheadline":"","legacy_arc_id":"GRT6IK47NZEJ3LGALZAPFH7TLY","arc_canonical_url":"\/civilian\/2019\/09\/13\/wannacry-hackers-face-sanctions-from-treasury-department\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n