A group of hackers believed to be behind North Korea stole South Korean users' Google ...

A group of hackers believed to be behind North Korea stole South Korean users' Google accounts and remotely controlled smartphones and tablets. Hackers infiltrated the victim's PC and distributed malicious codes to the victim's acquaintance in the version of Kakao Talk PC, and the victim's smartphone and tablet were remotely reset and deleted the data without permission.

This is the first attack by a hacking organization behind the state that has secured remote control rights and even carried out device location tracking and remote initialization.

"Google Android-based smartphones and tablet PCs in Korea were remotely initialized, causing data stored in the device to be deleted without permission," said the security center (GSC) of Genius, a South Korean security company, in a report on the 10th.

According to Genius, the attack is a new attack by the Connie APT campaign, which is known to be linked to the Kim Su-ki or APT37 group, the hacking group behind North Korea.

The hacking organization first infiltrated a specific person's terminal by downloading malicious files through a spear phishing attack (targeted phishing targeting a specific person) impersonating the National Tax Service. In the victim system, file names such as "guidance to request the submission of explanatory data according to reporting of tax evasion reports" that are believed to have been downloaded through such e-mails were confirmed.

The infiltrating hacking organization has been lurking on PCs for a long time and secured login information such as Google and Naver and sensitive information of victims through user monitoring.

In this way, the hacking organization even stole the Kakao Talk account of a psychological counselor specializing in North Korean defectors in South Korea on September 5 and sent malicious files disguised as "stress-relieving programs" to North Korean students in KakaoTalk contacts. As the recipient ran the file, the damage spread, and on September 15, another malicious file was distributed through another victim's Kakao Talk account.

The psychological counselor has received a report to the Gyeonggi Southern Police Agency after confirming that a message he had never sent was sent and suspected hacking damage.

The hacker organization not only spread malicious files, but also remotely attacked Android-based smartphones and tablets used by victims. They abused 'Find Hub', a function provided for Google's theft and loss device management.

In addition, it was found that the hacker organization carried out such remote initialization after confirming that the victim was outside using the location function.

There is also a possibility that the victim's PC's webcam may have been hacked. The report said, "The threat actors behind the state can exploit the webcam to secretly monitor the user's surroundings or identify the user's absence and carry out additional attacks," and explained that it could lead to privacy monitoring that stole the webcam.

To prepare for such attacks, Genius recommended changing the Google account password regularly and applying additional authentication methods such as two-step authentication.

He also explained that automatic saving of passwords should be avoided when logging in to a web browser.

Genius then said Google, a service provider, needs to review and apply real-time security verification measures such as additional authentication procedures, including reconfirmation of the device's actual owner.

Meanwhile, the security cyber investigation unit of the Gyeonggi Southern Police Agency said it is investigating a case of hacking by a North Korean human rights activist and has confirmed that the malicious code structure used in the crime is similar to that used mainly by North Korean hacking organizations.