North Korean hackers target Estonian IT experts

North Korean-linked hackers have tried to steal cryptocurrency and confidential information from Estonian IT experts, including computer specialist Tõnu Samuel, ERR reported in its programme Pealtnägija.

The case began on September 16, when a person using the name Muhammad Raza contacted Samuel on LinkedIn. Raza presented himself as the head of an artificial intelligence company based in Dubai and offered him work. Samuel said the message praised his skills and used a string of buzzwords, which he took as an early warning sign.

The company Raza claimed to represent was based in Argentina, another detail Samuel found suspicious. He said the offer was not obviously incompetent, but included empty and outdated phrases. The 54-year-old, whose LinkedIn profile identifies him as a chief engineer at a cryptocurrency company, quickly recognised the approach as suspicious and played along.

Nikolai Kunitsõn, an analyst in the analysis and prevention department of the Estonian Information System Authority, said the scheme was tailored to its target’s profile and skills. Samuel’s decision to continue the exchange helped authorities learn more about how it worked, Kunitsõn said.

Kunitsõn and Ago Ambur, the former head of the PPA cybercrime bureau and now chief executive of background-check company Glazer Technologies, said the approach was one of North Korea’s attack schemes.

North Korea has become a significant player in cybercrime despite its apparent technological isolation, Kunitsõn said. Ambur estimated that such operations bring the regime hundreds of millions, if not billions, of dollars a year.

Last Friday, reports emerged of what was described as the largest cyber theft in history: hackers allegedly linked to North Korea stole cryptocurrency worth $6.3 billion.

North Korean hackers first drew broad international attention in 2014, when Sony Pictures was attacked shortly before the release of The Interview, a film that mocked North Korea’s dictatorship and joked about an assassination attempt on its leader. The hackers broke into the company’s systems and released internal correspondence. Kunitsõn said the broader aim was to pressure Sony to cancel or delay the film’s release.

Estonia often discusses cyber and intelligence threats from Russia and China, but the Pealtnägija report said North Korean operations have also affected Estonians.