North Korea’s elite criminals turned on their own government – and were caught

For years, state-trained North Korean hackers have been among the world’s most prolific bank robbers — stealing large sums of money from foreign financial institutions, liquidating billions in cryptocurrency exchanges, and funneling the proceeds into the country’s weapons program.

But now, incredibly, some of the same high-profile hackers seem to have decided to hack their own government instead. And, it doesn’t sound like it’s over for them.

According to the report of Every day NKfocused on reporting on North Korea’s internal affairs, the country’s National Intelligence Agency busted a hacking ring on July 12 after uncovering a sophisticated scheme to steal the Chosun Central Bank and the Foreign Trade Bank – two institutions that sit at the heart of North Korea’s financial system.

The leaders of this group are said to be veterans who were released from the cyber operations unit under the Reconnaissance and Intelligence General Bureau of North Korea. That’s the shadowy military intelligence agency that runs the Lazarus Group, the criminals responsible for stealing billions from foreign banks and cryptocurrency exchanges over the past decade.

Those arrested are not members of Lazarus themselves, but – if the reports are true – they were trained in the same program, by the same institution, and have the same skills.

After leaving the military service, the veterans are said to have hired IT freshmen from Kim Chaek University of Technology and Pyongyang University of Science and worked to enrich themselves instead of filling the coffers of the North Korean government.

Using Chinese-made wireless equipment and encrypted messaging applications, the group allegedly hacked into the heavily guarded internal networks and foreign payment systems of both banks. Once inside, they are said to have taken different parts of the state’s trade funds into smaller amounts – in an attempt to avoid detection – and moved the funds to cryptocurrency wallets.

Brokers in China reportedly converted the cryptocurrency back into cash, while contacts in border areas exchanged the discarded funds for US dollars and Chinese yuan.

In short, the hackers are accused of building a smaller version of the same kind of money laundering infrastructure that North Korea has deployed internationally, and turning it inside out.

Unfortunately for the hackers, officials in Pyongyang began to notice small discrepancies in foreign currency payment authorizations and raised the alarm about suspicious access to overseas IP addresses. National Intelligence Agency investigators traced the encrypted cryptocurrency traffic to a facility in Pyongyang, and raided it on the night of July 12 – apparently catching the hackers as they spread the funds through their computers.

Computers and cellphones were seized by authorities, as part of the investigation.

Let’s not forget – all this happened under the North Korean dictatorship. Any punishment handed down by the authorities against criminals may not only be cruel, but also extend beyond the people involved to include their families.

NK Every day quoting a source reporting that the officer said he was responding to the case:

“They used the skills they were trained by the government to protect the country, instead they stole the country’s money. This exceeds the normal fines of the organization. It will be difficult for the whole family to survive.”