GMO Internet Group analysis points to North Korea-linked hackers behind October cyberattack, Kyodo reports
An internal analysis by Japanese internet infrastructure company GMO Internet Group found that a hacking group linked to North Korea was likely behind last month's cyberattack on the company, Kyodo News reported on Sunday, citing sources close to the matter.
An analysis by GMO Internet Group has found that a hacking group linked to North Korea was likely behind the cyberattack on the Japanese internet infrastructure company in October, Kyodo News reported on Sunday, citing sources close to the matter.
According to Kyodo, the company based the finding on characteristics of the malware used and other traces left by the attackers, and appears to have already reported the matter to the Japanese government.
Kyodo said that, working with security experts, it found that five IP addresses used to access a website claiming responsibility for the attack, immediately after the site went online, matched addresses previously used by a North Korean hacking group. Cybersecurity sources told the agency that the site also carried traces linked to several countries, including the United States and Japan, which may have been an attempt to mislead investigators.
GMO made the attack public on 21 October. Kyodo reported that the company last week confirmed customer information from its foreign exchange trading service had been leaked and used in fraudulent transactions, and that the attacker had threatened to publish customer data and carry out a ransomware attack. GMO did not respond to the demand, and some customer information was published on Tuesday 27 October, according to Kyodo.
Separately, the group’s authentication subsidiary GMO GlobalSign K.K. said personal information of at least 45,000 people at client companies had been leaked through its employee ID management service, Kyodo reported.
Sources
Related coverage
All technology →
Binance reports $3.64 billion net outflows in first hours after reopening withdrawals
Binance said customers withdrew US$4.65 billion and deposited US$1.01 billion in the first nine and a half hours after it began restoring withdrawals on Sunday, three days after a US$6.3 billion theft. The exchange said withdrawal volumes had since eased and that an updated proof-of-reserves report is due on Monday.
Chainalysis says hacker using 'offensive agentic techniques' accessed customer names and emails
Blockchain analytics firm Chainalysis said an outside attacker gained unauthorised access to its systems and internal tools this month and viewed customer names, email addresses, user IDs and role labels. The company said it has found no evidence that investigation content, credentials or session tokens were accessed, and that the incident is unrelated to the Binance theft.
FBI says North Korea was responsible for the more than $6 billion theft from Binance
The FBI said on Saturday that North Korea, through the unit it calls TraderTraitor, was responsible for the theft from Binance on or about 29 October. TRM Labs and Chainalysis had earlier assessed the same group. Binance says users will not bear the loss and that it has replenished about 90% of the stolen assets.
Japan Airlines says hackers accessed booking data of about 92,000 customers through Amadeus system
Japan Airlines and Japan Transocean Air say unauthorised access to the Amadeus passenger service system exposed reservation records of about 92,000 customers between August 2023 and September 2026, including passport numbers for about 2,000. The airline says no card numbers or passwords were taken.
North Korea fires about a dozen short-range ballistic missiles toward the East Sea amid a dispute with Seoul over a border landmine blast
South Korea's military said the missiles were launched from the Wonsan area and flew about 250 km. Seoul's presidential office said the launch violated UN Security Council resolutions and urged Pyongyang to stop. The launch came about a week after South Korea proposed military talks over the border.
Nikkei says 1.83 million personal data items leaked after cloud account breach
The Japanese media group said stolen credentials were used to access a cloud service used for system development on 7 October.
