FOLLOW US

The worm then is likely to have spread through a channel that links computers running Microsoft Windows in a network. The channel is typically used to share files within a network or to link to a printer, for example.

___

THE NORTH KOREA LINK

This method has been found in previously known North Korean cyberattacks, including the Sony hack in 2014 blamed on North Korea.

“Since a July 2009 cyberattack by North Korea, they used the same method,” Choi said. “It’s not unique in North Korea but it’s also not a very common method.”

Choi also cited an accidental communication he had last year with a hacker traced to a North Korean internet address who admitted development of ransomware.

The Russian security firm Kaspersky Lab has said portions of the WannaCry program use the same code as malware previously distributed by the Lazarus Group, a hacker collective behind the 2014 Sony hack. Another security company, Symantec, has also found similarities between WannaCry and Lazarus tools.

But it’s possible the code was simply copied from the Lazarus malware without any other direct connection.

If North Korea, believed to be training cyber warriors at schools, is indeed responsible for the latest attack, Choi said the world should stop underestimating its capabilities and work together to think of a new way to respond to cyber threats, such as having China pull the plug on North Korea’s internet.

“We have underestimated North Korea so far that since North Korea is poor, it wouldn’t have any technologies. But North Korea has been preparing cyber skills for more than 10 years and its skill is significant. We should never underestimate it,” Choi said.

___

FOLLOW THE MONEY

Researchers might find some additional clues in the bitcoin accounts accepting the ransom payments. There have been three accounts identified so far, and there’s no indication yet that the criminals have touched the funds.

Although bitcoin is anonymized, researchers can watch it flow from user to user. So investigators can follow the transactions until an anonymous account matches with a real person, said Steve Grobman, chief technology officer with the California security company McAfee.

But that technique is no sure bet. There are ways to convert bitcoins into cash on the sly through third parties. And even finding a real person might be no help if they’re in a jurisdiction that won’t cooperate.

___

TELL-TALE SIGNS

James Lewis, a cybersecurity expert at the Center for Strategic and International Studies in Washington, said U.S. investigators are collecting forensic information — such as internet addresses, samples of malware or information the culprits might have inadvertently left on computers — that could be matched with the handiwork of known hackers.