Following those links yield these two documents, which both have "Attribution" sections. Presumably some of these tell-tale signs were identified in the ongoing exploitation.
https://www.clearskysec.com/wp-content/uploads/2020/08/Dream...
https://securelist.com/operation-applejeus/87553/#attributio...
> One of the top identifiers of Lazarus is their dual attack mission – money theft and espionage. This modus operandi is unique to North Korea, as other state actors usually focus on espionage only. North Korean money theft operations are carried out in service of the government, as a way of funding the nuclear program
Like, seriously? "You not only do espionage but also steal money, therefore you're NK"?
This is about WannaCry, but it shows how multi-source attribution is done.
Lol
In the real world you can't possibly fake every single code comment left in Russian as long as these comments make sense and there's enough of them. It takes a lot of effort to actually truly fake something, at certain point it becomes the same as completely doing the job itself in order to properly fake it.
(Disclaimer: I am head of TAG)
The thing with trying to hide yourself is you have to do everything right to guarantee some false flag operation will work but if you make enough mistakes in this process there will be reasonably high-confidence links between some action and some person.
An example that I _have_ seen in some write up: some snippet of malware code showing up in a stack overflow question (with the shape and user variables being the same).
At one point it's like... probably that person. Of course maybe there are other indicators to the contrary but that's data for you. Gotta use your noggin a bit.
I ask because it’s broadly accepted that there are extremely powerful and wealthy entities in the West who benefit from an aggressive US foreign policy and heightened geopolitical tensions.
Hack something shoddy together, go to war/regime change/etc, and worst case if it does come to light that the "intel" was wrong, a well-placed "whoopsie-daisy" is enough to wash hands of all responsibility or scrutiny.
Just because you might not know what techniques the researchers here used to reach to that conclusion, doesn't mean they would have used dubious methods.
It is better to ask than attack a person.
To be precise. After the CIA made up reports of WMDs in Irak people should ask for receipts earlier.
[0]: https://www.reuters.com/article/us-usa-defense-cybersecurity...
Nope, Hacker News is the place where you be nice to each other on the internet rather than assuming they’re trying to manufacture consent. This is quite literally spelled out in the site guidelines.
https://www.clearskysec.com/wp-content/uploads/2020/08/Dream...
https://www.justice.gov/opa/press-release/file/1092091/downl... has a bunch of evidence that the Justice Department collected when charging some people associated with ATP38 around the Sony Pictures and WannaCry hacks (and other campaigns)
I'd note that things like shared encryption keys and shared TLS passive tables are very indicative of shared resources.
The use of North Korean IP addresses is indicative, but never enough on its own. However, the use of domains controlled by North Korean IP addresses is interesting as well.
Combine that with passwords largely shared with another North Korean attack, devices signed into from NK IP addresses under multiple accounts setup from N Korean IP addresses you start seeing a pattern of behaviour.
And then you find that the person who controlled accounts used by these attacks was a North Korean national (pg 134) who worked for a well known North Korean front company (paragraph 269, pg 136) and the evidence becomes pretty good.
Evidence is evidence. After WMD (which totally took me in, btw, you too?) Claims that evidence is "just over there" and "here are multiple different people reporting they've spoken to someone who saw it." Count for zero. Maybe they always should have but there's not doubt this stuff happens anymore. We watched it. (Hopefully) in horror as it unfolded without us objecting.
OTOH, the evidence linking APT38 to North Korea is pretty compelling. For example, there is a bunch of evidence collected independently identifying individuals associated with APT38, and these people worked for the North Korean company Chosun Expo.
See https://www.justice.gov/opa/press-release/file/1092091/downl... for the evidence in depth.
For what it's worth, quite a few people were skeptical about the WMD "evidence" at the time, and even more cynics like myself figured that true or false, it was mostly an excuse for George W to Do Something(tm) after 9/11 and at the same time finish off the war his dad started.