Lim Ji-hyeok, the leader of the wanted North Korean hacker group Andariel. Screenshot from X.

"What if a hacking attack cripples the hospital system, and a sick child can't receive treatment?"

His reason for continuing to track the North Korean hacker known as 'Hades' even after leaving the FBI was simple yet clear.

Raised by a nurse mother and an IT technician father in the healthcare industry, the hospital security systems attacked by North Korean hackers were as important to him as "top-secret military intelligence."

The Wall Street Journal (WSJ) reported on the 19th (local time) on the four-year pursuit of North Korean hackers by former FBI agent Eric Cure.

Cure, who worked in cybersecurity at the FBI, left his job in 2023 but still has an "unfinished investigation" he cannot abandon: uncovering the identity of the North Korean hacker 'Hades'.

Hades is a hacker belonging to Andariel, a hacking group under North Korea's Reconnaissance General Bureau, whose name is well-known in South Korea.

On May 4, 2021, Hades attacked the server of a hospital in Kansas, USA, completely locking down the system so that no one could access it. The network and equipment necessary for diagnosis and treatment, including the sleep study lab, became inoperable. It was a ransomware attack, where hackers seize and paralyze computer networks and then demand money for their restoration.

Hades demanded two Bitcoin, valued at $100,000 (approximately 150 million Korean won at current exchange rates), to restore the system. They also warned that if the Bitcoin was not paid within 48 hours, the demand would increase to $200,000.

Ultimately, the hospital handed over two Bitcoin to Hades. The Bitcoin was transferred to a Chinese bank and withdrawn from an ATM near Dandong, China.

When the U.S. government indicted individuals involved in this case, they revealed the name and photograph of Lim Ji-hyeok, who led the operation. However, Hades, whose identity could not be confirmed, was left as 'accomplice 1'.

Disguised North Korean IT personnel. Yonhap illustration

This is why Cure, alerted by North Korean hackers' attacks on hospital security systems, decided with his FBI colleagues to pursue the elusive 'accomplice 1'.

He pretended to be preparing to open a "cryptocurrency casino" and proposed a partnership to North Korean hackers. Through this, he narrowed down suspects who could be 'accomplice 1' based on information obtained during the Andariel investigation.

He is confident that the North Korean hacker he contacted in July is 'Hades'. He used terminology identical to what Hades used in social media profiles and other contexts. Evidence of using the same phone number as Hades was also detected.

The suspect proposed to Cure that he would create a money laundering system for him and boasted about earning over $1 million in the past by developing ransomware.

Cryptocurrency and cybersecurity experts emphasize that there are many cases of North Korean hackers posing as IT personnel of U.S. companies to commit crimes. The goal of North Korean hackers is to gain system access privileges to carry out more significant crimes than mere intrusion.

Cure plans to present the evidence he has gathered so far at a conference in Washington D.C. on the 20th.

Yonhap News