North Korean hackers behind Japan’s massive GMO data leak, investigation finds

An analysis by Japan’s GMO Internet Group found that a North Korea-linked hacking group was likely behind the cyberattack on the company last month, sources close to the matter said, citing characteristics of the malware used and other traces left by the perpetrators.

The company appears to have already reported the matter to the government and will now focus on determining the full circumstances.

Kyodo News, working with security experts, also found that five IP addresses used to access a website claiming responsibility for the attack immediately after the site went online matched those previously used by a North Korean hacking group.

The website contained traces linked to multiple countries, including the United States and Japan, suggesting the hacker may have tried to mislead investigators through a false flag operation, cybersecurity sources said on Sunday.

A separate analysis of the site found that its domain had been acquired from a US company on September 1 and that its hosting server was provided by the same company. File creation times were set to a US time zone, while the operating system was set to English.

Part of a programme used to collect visitor logs contained Japanese text and showed characteristics suggesting it had been generated by artificial intelligence. Files posted on the site were created using software developed in China and widely used there.

A website for victims of the GMO cyberattack to share information may have been set up by the attacker, as its web structure bears many similarities to that of the site used to claim responsibility for the attack, an analysis by security experts found on Saturday.

The attacker possibly sought to get information from victims through the “victim information sharing forum” website, the experts said.

The website was registered on October 19, two days before the Japanese internet infrastructure provider made the cyberattack public, according to the analysis. The information-sharing website was confirmed to be available as of October 22.

Both websites have similar overall designs and share parts of their source code, making them “pretty much identical”, one of the experts said.

Last week, the company confirmed that customer information related to its foreign exchange trading service was leaked without authorisation and used in fraudulent transactions. The hacker threatened to disclose customer information and conduct a ransomware attack.

GMO did not respond to the request, and some customer information was disclosed on Tuesday. One of the victims said they received multiple emails on the night of October 22 from someone using a Russian-sounding name claiming to be the attacker.

Meanwhile, GMO GlobalSign, the company’s authentication business subsidiary, said personal information of at least 45,000 people at client companies had been leaked through its employee ID management service.

Japanese Defence Minister Shinjiro Koizumi and his US counterpart, Pete Hegseth, agreed on Wednesday to strengthen cooperation in dealing with cyberattacks after the recent large-scale breaches, Japan’s Defence Ministry said.

At their talks in the Philippines, the ministers concurred to coordinate to prevent malicious cyber activities from having serious impacts on lives, economic activities and “ultimately our national security”, the ministry said.

On Saturday, the FBI said North Korean hackers orchestrated the theft of billions of dollars from Binance within a matter of minutes, the biggest crypto heist in history, was orchestrated by North Korean hackers.

The bureau said in a statement that last week’s attack was tied to “malicious cyber activity” by an entity known as TraderTraitor, the same actor behind a US$1.5 billion Bybit hack last year.