The White House publicly declared Tuesday that North Korea was “directly responsible” for the WannaCry ransomware cyber attack which shut down hospitals, banks and businesses across the world in May.
Computers running Microsoft Windows had their entire contents restricted and users were ordered to pay a ransom fee if they wanted their data unlocked. The attack affected some 300,000 computers across 150 countries, causing billions of dollars’ worth of damage. European police agency Europol described the scale of the cyber attack as “unprecedented”.
The Washington Post initially reported in June that the National Security Agency (NSA) blamed North Korea for programming and releasing the computer worm. The British government officially declared Pyongyang responsible in October. However, this is the first time the CIA and United States administration has formally acknowledged that North Korea was behind the attack.
White House aide and homeland security adviser Thomas Bossert made the accusation in a Wall Street Journal op-ed Monday evening, writing:
“The [WannaCry] attack was widespread and cost billions, and North Korea is directly responsible. We do not make this allegation lightly. It is based on evidence. We are not alone with our findings, either.”
According to Mr. Bossert, the U.K. government and OS manufacturer Microsoft had also blamed Pyongyang for the cyber attack. “North Korea has acted especially badly, largely unchecked, for more than a decade, and its malicious behavior is growing more egregious,” he wrote. Adding, “As we make the internet safer, we will continue to hold accountable those who harm or threaten us, whether they act alone or on behalf of criminal organizations or hostile nations. The tool kits of totalitarian regimes are too threatening to ignore.”
Mr. Bossert described the WannaCry virus as “indiscriminately reckless” and said that North Korea must be held accountable for its actions. He claimed that the United States planned to continue to use a “maximum pressure strategy” to hinder the Hermit Kingdom’s ability to wage cyber warfare. Though he did not specify exactly what type of action the U.S. administration was planning.
He told reporters Tuesday morning that much of the information that allowed the CIA to identify North Korea as the culprit is still classified. However, he did say that there were “technical links to previously identified North Korean cyber tools” stemming from the NSA arsenal that helped the agency trace the origin of the ransomware to Pyongyang.
North Korea is also suspected of hacking cryptocurrencies such as Bitcoin in an effort to profit from their unprecedented surge in value. Kim Jong-un reportedly made more than $100 million from digital currencies over the past year. Allegedly helping him to circumnavigate economic sanctions imposed by the United Nations resulting from North’s continued nuclear weapons program. This prompted the U.S. administration to call on “all responsible states” to help counter North Korea’s capability to mount cyber attacks and impose all relevant U.N. Security Council sanctions.
The WannaCry ransomware was traced to an advanced persistent cyber threat organization called Lazarus Group, which is accused of having connections with North Korea. The group also launched an attack on Japanese multinational Sony Corporation before the release of a movie showing Kim Jong-un being assassinated and is suspected of coordinating an attempted bank heist on the central bank of Bangladesh.
The WannaCry cyber attack on May 12 hit many key sectors of the economy, including healthcare facilities such as the U.K. National Health Service (NHS) which was forced to turn away patients and put lives at risk. Russia was also badly affected by the malware and suffered major disruptions to its domestic postal service.
At the time, North Korea was widely suspected of manufacturing the virus that demanded money to restore access to victims’ computers. However, the U.S. government had not stated so much publicly until earlier this week. Pyongyang denied responsibility for the attack, dismissing the accusation as “groundless speculation” and describing it as a “wicked attempt” to impose additional economic sanctions on the country.