N. KOREAN MALWARE USED IN PHONE SCAMS

[Anchor Lead]

Phishing crimes are becoming more and more sophisticated with scammers falsifying phone numbers of incoming calls using malicious apps. Government authorities confirmed that the malware's seller was in fact a North Korean IT agent. They also put in hands a video sent to a group of voice phishing scammersin Dandong by a North Korean IT worker selling the application.

[Pkg]

This is a video sent to a group of voice phishing scammers from a malicious app vendor in Dandong, a hub for Chinese voice phishing organizations. A man explains how he would install a malicious app on the target's mobile phone and continue to manage it.

[Soundbite] "This call app is the latest version. Install it and give permission."

North Korean spelling of particular words are seen on the screen written in Korean and used in the man's narration. The man demonstrates how he can falsify the caller number shown on the compromised mobile phone.

[Soundbite] "The caller numbers that come into this device are shown as '1111111'."

A call from China is made to look like it is from a credible Korean financial institution. He demonstrates how a voice phishing crime ring can hijack a target's phone call when the target suspects a scam and calls an actual financial institution to doublecheck.

[Soundbite] "When a person calls 123456 from his device, the call comes to this preset number."

[Soundbite] "123456 is calling. The device receiving this call is shown as this number."

Once a malware is planted on a mobile phone, the target sees the number of a Korean financial institution on the screen and all the calls that the target makes for confirmation is directed to the voice phishing call centers based in China. Government authorities confirmed that the malware's seller was a North Korean IT agent. A large number of malicious apps used by the Chinese phone scammers are presumably made in North Korea. But it is difficuult to prove North Korean intervention because most of the transactions are carried out by brokers.

[Soundbite] Prof. Lim Jong-in(Korea Univ. School of Cybersecurity) : "They are completely specialized, so even when Korean authorities make arrests, they only catch low-rank collectors."

Investigators believe that South Koreans are main targets, given that the malicious app is in Korean.