Twitter Suspends Two Accounts of North Korean Hackers

[Asia Economy Reporter Yujin Cho] On the 18th (local time), major foreign media reported that Twitter suspended two accounts belonging to hackers supported by the North Korean government.

The suspended accounts, '@lagal1990' and '@shiftrows13', were operated by hackers affiliated with the North Korean government who conducted cyber espionage by creating fake security-related blogs targeting cybersecurity researchers worldwide and distributing links that could implant malware.

After accessing the researchers' computers, the hackers are believed to have stolen undisclosed vulnerability hacking software or conducted espionage activities against the researchers' employers, such as security companies or government agencies, which are traditional hacking targets, according to foreign media reports.

The two accounts suspended this time posted cybersecurity-related content, including code related to recently discovered security vulnerabilities, attempting to gain a reputation in the information security industry.

Adam Weideman, a security risk analyst at Google's Threat Analysis Group (TAG), confirmed that Twitter suspended these accounts, stating, "We have confirmed that these two accounts are directly related to activities discovered by our group earlier this year," and pointed out, "They have been operating while changing account names."

These activities, which began last year, were first discovered by Google's TAG in January of this year. Even after being detected by Google, these North Korean hackers did not cease their cyberattacks.

At that time, Google revealed that the North Korean hackers had been active for months on various social networks such as Twitter, LinkedIn, Telegram, Discord, and Keybase, creating fake security researcher identities.

The hackers used these fake identities to build reputations by posting information security-related content and then approached other security researchers.

When other security researchers responded, the hackers lured them to sites containing malicious JavaScript code under the pretense of collaborating on projects, infecting their computers with malware.

In March, Google also announced that it had identified new Twitter accounts linked to this espionage activity, as well as a fake cybersecurity company named 'SecureElite.'