There's also the possibility that the APT group is partially or completely composed of foreigners hired to engage in these attacks on behalf of the DPRK. I know one of the people on Operation Blockbuster believed that this was "contracted out" to some clandestine group. This would explain the attackers being multi-lingual. It would also explain why many of their attacks focus on financial institutions and theft. This focus has been proposed as a way for the DPRK to get international currency to make purchases and evade sanctions, but it would also make sense for a group that is in it for the money.
Actually the whole "we don't like movies about Dear Leader" supposed motivation is only superficially reasonable. From the leaked email it's clear that this was a chaotic capricious organization that wouldn't have hesitated to fire embittered IT (or simply IT-aware) staff, who would then have been well-placed to do everything that was done to Sony. (I especially liked the unencrypted Word docs they had of nothing but hundreds of passwords. Passwords don't belong in Word docs!) "Guardians of Peace" had a special hatred for Sony execs, while e.g. Rogen and Franco were afterthoughts.
1. https://www.businessinsider.com/north-korean-hackers-working...
I agree with the analysis linking the groups.. however, the final conclusion is because the other attacks were attributed to NK, then we must also attribute these attacks to NK.
I think these assumptions need to be questioned.
The sophistication of the attacks is so out of proportion with North Koreas abilities, it almost reaches the point of absurdity.
I mean we're talking about an entire country full of people that are denied access to the internet, most do not have computers, and many don't even have the electricity to run them. We're talking about a country where refrigerators are luxury and purchased by the middle class to store books since they don't have steady electricity that would allow them to keep food cold.
When you look at the sophistication of the attacks, it's an amazing leap to assign such sophisticated cyber attacks to a country that runs it's entire computer infrastructure as an government controlled Intranet that people still access over dial-up modem.
I mean even just using Occams razor on the South Korean bank attacks...
You're going to require extremely educated people, who have the requisite hacking skill and mindsets, which often require unfettered access to information that is denied to most everyone, and small details like the fact that the attackers also are knowledgeable in multiple spoken languages and other things that are so out of the ordinary for NK.
What is more likely.. that all of these sophisticated attacks are being done by a country that can barely keep the power on, or that they are done by someone pretending to be North Korea and using them as a scapegoat?
Personally I think it's the latter.