NK hackers behind martial law email

[Anchor]

Since the declaration of emergency martial law last year, emails titled "Disclosure of Martial Law Documents" have been sent randomly.

The police tracked this suspicious email and found it to be a phishing email distributed by a North Korean hacker organization.

Reporter Shin Ji-soo has the story.

[Report]

This email was distributed a week after the declaration of emergency martial law on December 3.

It was a phishing email with the subject "Disclosure of Counterintelligence Martial Law Documents," which executed malicious software when the attached file was downloaded.

The police, who have been tracking the sender, concluded that it was the work of a North Korean hacker organization.

This conclusion was drawn because the same domain used in past North Korean cyber attacks was employed, and the IP address was confirmed to be from a region in China bordering North Korea.

Additionally, there were numerous instances of North Korean-style language usage found in internet search records, such as using "페지" instead of "페이지" and "기동" instead of "시동."

[Kim Young-hee/Visiting Researcher, North Korea Studies Institute, Dongguk University: "In South Korea, we say '페이지,' but in North Korea, they say '페지.' When referring to operating machines, they often use the term '기동.'"]

They also sent many phishing emails with subjects that would attract people's interest, such as tax refunds or today's fortune, which linked to fake sites asking for IDs and passwords when the 'shortcut' was clicked.

These were cleverly altered forms of major portal site addresses, making them easy to mistake for the real sites.

[Kim Young-woon/Head of Cyber Terror Investigation Division, National Office of Investigation: "(The phishing site) appears to be a normal site at first glance. If you access the phishing page and enter your information, that information is separately stolen."]

The police estimate that the North Korean hacker organization sent 120,000 emails to 17,000 people over two months starting in November last year, stealing personal information from 120 individuals.

This is KBS News, Shin Ji-soo.