The malware came with a mechanism hard-coded into it that allowed the attackers to shut down the self-replicating chain of attacks. 'This opens a lot of possibilities for everyone to find other similarities between all versions of WannaCrypt that have been found so far, and the tools used by Lazarus,' Maarten van Dantzig, a researcher at FOX-IT, told Ars.Ī tie to North Korea might explain some of the unusual behavior researchers have observed in last Friday's outbreak. Other researchers agreed that the shared code between WCry and Cantopee was important. In early 2015, the Obama administration took the unusual step of sanctioning North Korea after saying US intelligence sources were confident the rogue nation was responsible for the Sony hack. Kaspersky Lab has authored reports here and here that further document the group, including its ties to North Korea. It first came to light in a report published in February by security firm Novetta. One thing is for sure-Neel Mehta's discovery is the most significant clue to date regarding the origins of WannaCry.' 'For now, more research is required into older version of WannaCry,' the Kaspersky Lab researchers wrote in a blog post headlined ' WannaCry and Lazarus Group-the missing link.' 'We believe this might hold the key to solve some of the mysteries around this attack. The Cantopee code snippet, the researchers explained, was removed from later versions of WCry, making it hard to spot and hence ill-suited to act as a decoy. Researchers at antivirus provider Kaspersky Lab said such a 'false flag' is plausible but improbable. WCry's creators may have deliberately added code found in Cantopee in an attempt to trick researchers into mistakenly believing Lazarus Group is behind the ransomware. The haystack needle Mehta presented Monday now connects Lazarus to WCry, although the tie connecting the two isn't precisely clear just yet. The outbreak was largely contained because the attackers failed to secure a domain name hard-coded into their exploit. Businesses and government agencies all over the world quickly disconnected computers from the Internet, either because they were no longer working or to prevent them from being hit. Infected hospitals soon responded by turning away patients and rerouting ambulances. Also known as WannaCry, the self-replicating malware encrypted hard drives until victims paid ransoms ranging from $300 to $600. Previously discovered code fingerprints already tied Lazarus Group to the highly destructive hack that caused hard drives in South Korea to self-destruct in 2013, wiped almost a terabyte's worth of data from Sony Pictures in 2014, and siphoned a reported $81 million from the Bangladesh Central Bank last year by sending fraudulent messages using their credentials on the SWIFT network used to transfer funds.įurther Reading An NSA-derived ransomware worm is shutting down computers worldwideOver a matter of hours on Friday, Wcry used leaked National Security Agency-developed code to attack an estimated 200,000 computers in 150 countries. The tweet referenced identical code found in a WCry sample from February and an early 2015 version of Cantopee, a malicious backdoor used by Lazarus Group, a hacking team that has been operating since at least 2011. The link came in a cryptic Twitter message from Neel Mehta, a security researcher at Google. Jo Christian Oterhals reader comments 108 withĪ researcher has found digital fingerprints that tie the WCry ransomware worm that menaced the world on Friday to a prolific hacking operation that previously generated headlines by attacking Sony Pictures, the Bangladesh Central Bank, and South Korean banks.

Lazarus group wannacry neel meheta