- When you hear the phrase
"The world's most successful bank robbers",
what are the first images that come to mind?
Probably picture something like de Niro
and his crew in heat, right?
Guys in masks, big guns storming in, taking
hostages and doing the whole thing that bank
robbers do, which is, well, rob banks.
However, the group that US security officials have
called 'The most successful bank robbers in the world',
aren't like that at all.
They're a new kind of bank robber,
and they represent an entirely different crime.
We're talking about the Lazarus group, a hacker collective
that has grown exponentially over the past decade.
Even if you don't know the name, you're
probably familiar with some of their work.
They aren't just robbing banks, they're
robbing a whole lot more.
And whether you know it or not,
you are being affected by their actions.
So let's start from the beginning.
Even though many believe they were operational before this,
the first major action that can conclusively be traced
to Lazarus was operation Troy in 2009.
This large scale instance of cyber espionage
where they effectively hacked the White House,
the Pentagon, the New York stock exchange,
Nasdaq, the Washington Post, and Amazon,
just a few small, insignificant organizations.
Even though this was a highly successful hack,
unless you ran in cybersecurity circles, you probably
still hadn't heard of Lazarus in 2009.
- And now I'm about to hack
your world into pieces, old man.
Looks like someone with a catalog model in Japan.
Whoah, those boots?
- Their big public debut in so many
ways came a few years later.
Much like trolls or anyone doing unsavory things
online, hackers take great pains in remaining anonymous.
And a group like Lazarus will often adopt
different names and aliases for new operations.
In 2014, they did their most impactful action yet.
And they did it under the moniker of guardians for peace.
This was the hack of Sony pictures.
And you might remember this one.
It got a whole lot of press coverage,
and it makes sense why.
It was a giant hack of a major motion picture studio.
This led to the leak of thousands of
confidential emails from top executives, producers, and actors.
Many of the most scandalous of these emails were
republished on Gawker, and this led to a lot
of embarrassment as well as some high profile resignations.
And while the leaked emails got most of
the public attention, there was another component to
this hack that was far more important.
They obtained 47,000 Social Security numbers from the Sony
computer network. Though, nobody knows the exact number,
estimates for damages here range between $35 and $80 million,
not to mention a sucker punch to reputation.
Now, you might ask, why would a group
that previously targeted the White House and Pentagon
set their sights on a movie studio?
Isn't that a bit of a step down?
And the answer is simple.
They wanted to stop the release of a movie.
- We're going to be in a room alone with Kim, and
the CIA would love it if you could take him out.
- You want us to kill the leader of North Korea?
- Yes
A comedy starring Seth Rogan and James Franco
about the assassination of Kim Jong Un.
They were willing to halt the release
of this movie by any means necessary.
So now, if you don't already know, maybe starting to
guess who backs the Lazarus group, which will start to
show you why their actions are absolutely wild
compared to your average hacker, North Korea is
one of the most notorious dictatorships in the
world and also the least understood, which is
very intentional on their part.
There's a reason it's known as the Hermit Kingdom.
Since its founding in 1948,
North Korea has been shrouded in secrecy.
Almost no information escaped North Korea
and even less enters.
And that's why this story is so ironic.
One of the modern world's most successful hacking
collectives came out of North Korea, which has
no public Internet and limited electricity.
If you fly over the Korean peninsula at
night, you'll see bright lights from both South
Korea and China, with North Korea sitting in
between them, a total expanse of black.
In North Korea, cybercrime isn't something
that just occurs in the shadows.
This is a function of their government
and a major source of revenue.
They train their citizens to do
this, and they start them young.
Imagine you're growing up in America or Finland
or France or really any modern Western democracy.
In second or third grade, it starts to look
like you're getting pretty darn good at math.
What happens next?
Maybe your teachers tell your parents about it.
Maybe they move into some kind of gifted program.
You'll surely get told about future
careers that need this talent.
You could become a doctor,
an engineer, a computer scientist.
The possibilities are really endless.
Now, imagine you're growing up in North Korea,
and from a young age, you showed the
exact same level of mathematical talent.
In some ways, the result would be very similar.
You'll luckily be plucked from your class and placed
into a special program for highly gifted students.
You'll begin to learn a much more
advanced level of mathematics, except in this
case, you already know your career path.
You know what you're being trained for,
to become a cyber warrior, a hacker.
In North Korea, a hacker syndicate like
Lazarus does not operate outside the law.
They're funded by, protected by, and working
directly for the North Korean government.
So you, the child prodigy,
graduate from your secretive training program, and
you're ready to enter the workforce.
The next question is,
Because remember, North Korea has no public Internet,
and this is very much on purpose.
The North Korean government, ever since it was founded, has
taken great pains to keep their citizens in a kind
of cultural bubble, surrounded by constant pains of pro government
propaganda and little or no knowledge of what life is
like throughout the rest of the world.
But hackers hackers obviously need to
get access to the internet.
So where do they go?
The answer is China.
Members of Lazarus work out of locations
all throughout China, often owned by Chinese
businesses with ties to North Korea.
Think about the cramped tech houses of Silicon Valley,
where companies like Facebook were founded.
Except in this case, rather than building
something, they're all working to steal from
governments and institutions. Geniuses, all working together
to steal as much as possible.
This is why Lazarus is so
effective and so insanely dangerous.
This is a job for the best and brightest
of an entire country, and not an easy one.
Your lifestyle as a North Korean
cyber warrior is extremely demanding.
You wake up at 6 AM sharp,
you sit down at your computer, and you'll
often work 10, 15 or even 20 hours straight.
You work this hard because you have a quota.
If you missed that quota, you could
be sent back to North Korea.
- But if you don't meet the quota, and the
minders will make sure that they'll put enough pressure
on you, and if that happens repeatedly, you will
face the growing odds of being sent back home.
- And that's the key here.
The reason why you work so hard to remain
so motivated is because as difficult as these circumstances
are, you're still living a far better life than
you would if you were back home.
You're better fed.
Even though your life is highly restricted, you still
enjoy more freedom than any of your family members.
You can go online, maybe watch some movies,
and get some even fleeting glances at what
the larger world is actually like.
- Hulu, Netflix, HBO Max.
I got all the accounts and passwords you need.
- This brings us to one of the biggest ironies at play here,
and this is the reason this group is such a
perfect symbolic example of the two sides of digital progress.
As a hacker, you're working like a machine in
order to steal money, cause chaos, destroy lives, and
do anything you can do to strengthen North Korean
dictatorship to essentially help your life.
Yet, in doing so, some of these hackers can't
help but also learn about the free world, about
the things that they had no access to when
they were growing up in North Korea.
After all, the only reason we have any
of this information about how Lazarus functions are
through defectors, former members of the group who
left North Korea, never to return,
and becoming hackers
and committing this largescale cybercrime for the
government, they also started seeing through the
propaganda, getting an understanding that there's far
more to the world than the pro
government messages that they grew up with.
- On every Saturday, they have to do this
propaganda session, which is basically about gathering all
the hackers together into a room.
And they have to recite whatever
messages, whatever lines come from Pyongyang.
These are the dual sides of progress.
A digital age helping to show what the outside world
is actually like, while simultaneously making it much easier for
a small focus group to cause massive damage.
Now that we know a little bit more about Lazarus,
who they are, what they do, how they work,
let's talk about some of their more recent actions.
Because as devastating as the Sony hack was,
it could almost be seen as a rehearsal
for a far more ambitious hack that Lazarus
would attempt just two years later in 2016.
This is when they attended to steal close to
a billion dollars from the Bangladesh National Bank.
That's billion with a B.
This is a totally insane thing to do.
And here's how it happened.
In January 2015, they got into the Bangladesh Bank system by
sending out a fake CV for a fake job candidate.
Pretty common trick used by hackers.
As soon as someone inside the bank
opened the attachment, they were in.
The goal was to take $951 million at the Bangladesh
National Bank that had sitting in the New York Federal
Reserve and transfer it out to their own accounts.
After lurking in the systems for a year,
they made their move in February 2016.
And the timing was very intentional.
This was the start of the lunar New year in Asia.
So the plan was to steal the money and
transfer it to multiple Philippine banks where there would
be no one available to answer the phones,
thanks to that holiday. Every step
of this operation was planned out meticulously.
They even remotely sabotaged a printer
at the Bangladesh Bank that was used
to print off large transactions as they
happened, buying them even more time.
They just thought the printer was busted.
But meanwhile, a billion dollars was
being funneled out of their system.
This was an incredibly audacious thing to do.
And the reason that they didn't fully
succeed was a matter of total chance.
As I said, the plan was to move $951 million
out of the New York Fed and then spread
it out across several banks in the Philippines.
Well, in RCBC bank branch in Manila, where
the hackers were trying to transfer, some of
the money was located on Jupiter Street.
And Jupiter, in total coincidence, also happened to be
the name of a sanctioned Iranian shipping vessel.
So that word was tagged by the
New York Fed's automated computer Systems.
Again, this was not because they had any
idea about Lazarus or North Korea, but because
of a totally unrelated Iranian shipping vessel.
Just plain bad luck for the Lazarus fellows.
So this caused payments to be
reviewed where they were then halted.
However, about $101 million still went through.
This is obviously far below what they were going after,
but still a significant hit for Bangladesh, a country where
one in five citizens live below the poverty line.
The sheer audacity of Lazarus, the fact that they
would even attempt something so huge, puts them on
a whole different level from most hackers.
And they have this audacity
because they aren't independent criminals.
They are backed and totally protected
by the country of North Korea.
And also, North Korea really, really needs the money.
Due to so many reasons, human rights abuse,
nuclear threats, and extreme aggression towards
their neighbors, North Korea has been living
under crippling trade sanctions through the UN.
These sanctions have devastated their GDP, and
so cybercrime is now one of the
country's largest sources of revenue.
However, we shouldn't make it sound like this is new.
North Korea has been making
money illegally for many years.
Back in the 90s, they were involved
in counterfeiting, human trafficking and weapons sales.
North Korea, even at one point, was manufacturing
some of the purest Meth in the world.
- Jesus, you got crystals in here
two inches, three inches long.
This is pure glass.
You're a goddamn artist.
- Hacking is just the latest evolution
of what they've always been doing.
And the money they steal goes to all
sorts of functions for the government, including nukes.
And sorry to be a bummer, but this is why
the actions of the Lazarus Group affect us all.
Because even if you've never been personally impacted by
one of their operations, even if you don't care
about some other country's national bank being rated, even
if you've never particularly like Seth Rogen, a nuclear
North Korea is something that no one wants.
In 2019, North Korea spent an
estimated $620 million on their nuclear program.
And you better believe that a good chunk
of that came straight from Lazarus Group operations.
In the last few years, Lazarus has continued to expand.
A few of their more recent operations are the
WannaCry hack, a global attack that was the
first widespread use of a crypto worm.
This new type of computer virus can
spread between connected computers without anyone ever
needing to open a bad link.
Then they capitalize on the COVID pandemic by trying
to hack into various pharmaceutical giants trying to steal
proprietary vaccine tech, or take their recent highly successful
hack of Axie Infinity, the play-to-earn game.
In that case, they infiltrated Ronin, a utility
connected to the game, stealing over $600 million.
Lazarus is seen within North Korea
as an extension of their army.
And what they represent is something that
military type people call an "asymmetric threat".
Basically, that means a threat that's coming from
a source that is seemingly much smaller and
much weaker than its intended target.
North Korea does not have a large army, but
through the Lazarus Group, they're able to steal huge
amounts of money and cause global chaos.
The WannaCry hack affected the British
National Health Services so deeply that they
had to cancel all non-emergency procedures.
Because here's the truth, we
live in an extraordinary time.
The increasing digitization of our world has
created more positive opportunities than ever.
But there's a flip side to this.
The technology means a small government has the
capability to undermine global institutions, stealing more money
than John Dillinger had ever dreamt of.
So as we continue to upgrade to
new technologies, it's important to recognize both
the good as well as the bad.
And maybe, just maybe, take a moment before you open
an email attachment from someone that you've never met.
This video is help made possible by FTX.
Through FTX, you can safely buy cryptos, NFTs
and other digital assets, all for as much
as 85% cheaper than other exchanges.
Something nice about FTX is they have two versions
a super easy to use and simple app, as
well as a more advanced platform that offers tons
of different tools tools for traders.
So grab the link in the description, support this
channel, and get an additional 10% off for life.