The Wall Street Journal (WSJ) quoted investigators tracking down the North Korean agents as saying they are characteristic of the North Korean agents. The Wall Street Journal added that the North Koreans’ affection for the “Superbad” series is a joke that is somewhat embarrassing but repeated among security researchers investigating them.
The “Superbad” series is an animation produced by Illumination Entertainment that depicts the adventures of the supervillain, Gru. In particular, Gru’s subordinates, the yellow minions, became popular for their cuteness and became the mascot of Illumination.
Investigators who were tracking North Korean disguised workers initially suspected that the suspected North Korean agent used the word “Gru” in his account name, meaning the Russian General Reconnaissance Service (GRU), but the agent was a fan of the “Superbad” series.
A North Korean agent disguised as a worker informed the company of the software he created on a code-sharing site to get a job at an information technology (IT) company in the United States, using the account name “Grudev325. During the job interview, the agent said, “I like Superbad.” Gru meant the character of the main character of Superbad, not Russian intelligence.
The Grudev325 account agent was fired from his job a month later due to lack of skills, but two years later, he participated in a cryptocurrency project and stole $62 million.
Taylor Monahan, an investigator who works for the cryptocurrency company Metamask, said he has been tracking virtual currencies stolen by North Korean agents for years, and he realized that “many of the disguised employees like Minions” characters like Minions frequently appear on GitHub’s account name or Telegram account profile, which is a developer-sharing platform.
For this reason, investigators have come to regard it as a signal that they have found the right address when hints related to “Superbad” characters such as Minions appear in the process of tracking down North Korean agents. In fact, some North Korean agents used the pseudonym “Kevin” at disguised employment companies, and Kevin is also the name of a major Minion character in the “Superbad” series. A North Korean agent who used Kevin for the name of the activity said, “I even spent time searching for ‘Superbad’ characters during working hours,” a security company executive tipped off.
Monahan said North Korean agents seem to be simply fans of animations rather than having any intention of using the “Superbad” character frequently, adding, “How can they not like Minions?”
North Korea is found to have been engaged in hacking and fake employment at a global IT company, and is systematically earning foreign currency. The U.S. Department of Justice indicted four North Koreans who were hired by a U.S. IT company on June 30 and are systematically earning foreign currency.
According to the U.S. government, thousands of North Korean workers have been working in lucrative technology jobs by infiltrating companies in the U.S. and around the world over the past few years, pretending to be citizens of other countries. Google’s Threat Information Group said in April that North Korean IT workers are increasingly moving to infiltrate European companies by disguising themselves as remote freelancers.
They used false personal identification information that they stole and got a job at a tech company. Some of the companies are known to be famous. After employment, they are accused of accessing virtual currency assets managed by the company, embezzling virtual currency assets, and laundering the profits. Their profits amount to hundreds of thousands of dollars.
The South Korean and U.S. authorities believe that the North is raising funds to develop weapons of mass destruction (WMD) through disguised employment of IT personnel. The U.N. panel of experts estimated in a report last year that workers in the North’s IT sector earned between 250 million and 600 million U.S. dollars a year.
SOPHIA KIM
US ASIA JOURNAL
