Suspected North Korean Hackers Targeted AstraZeneca in Covid Vaccine Race, Sources Say

The approach came as a job offer. According to two people with knowledge of the matter who spoke to Reuters, staff at the British drugmaker AstraZeneca were contacted in recent weeks by people posing as recruiters on LinkedIn and WhatsApp. The contacts were fake, and the sources attribute them to suspected North Korean hackers.

After making contact, the supposed recruiters sent documents presented as job descriptions. The files were laced with malicious code designed to give the hackers access to a victim's computer. One of the sources said the attempts reached a "broad set of people," including staff working on Covid-19 research. The sources do not believe the attempts succeeded.

The timing matters. AstraZeneca has emerged as one of the top three Covid-19 vaccine developers and is racing to deploy its vaccine. The company declined to comment. The North Korean mission to the United Nations in Geneva did not respond to a request for comment, and Pyongyang, which has no direct line of contact for foreign media, has previously denied carrying out cyberattacks.

The sources, who requested anonymity because the information is not public, said the tools and techniques pointed to an ongoing hacking campaign that US officials and cybersecurity researchers have attributed to North Korea. According to three people who investigated the attacks, that campaign had previously focused on defence companies and media organisations, then pivoted to Covid-related targets in recent weeks.

One source added a detail that complicates the picture: some accounts used in the attacks on AstraZeneca were registered to Russian email addresses, a possible attempt to mislead investigators.

The episode fits a wider pattern. Cyberattacks on health bodies, vaccine scientists and drugmakers have soared during the pandemic, as state-backed and criminal groups scramble for the latest research. Western officials say stolen information could be sold for profit, used to extort victims, or hand foreign governments a strategic advantage in fighting a disease that has killed 1.4 million people worldwide.

Other reports line up with this one. Microsoft said this month that two North Korean hacking groups had targeted vaccine developers in several countries, in part by "sending messages with fabricated job descriptions," though it named no organisations. South Korean lawmakers said on Friday that their country's intelligence agency had foiled some of those attempts. Reuters has also reported that hackers from Iran, China and Russia tried to break into leading drugmakers and even the World Health Organisation this year; Tehran, Beijing and Moscow have all denied it.

North Korea has a record that US prosecutors have spelled out. They blame it for the 2014 hack and leak of Sony Pictures emails, the 2016 theft of $81 million from the Central Bank of Bangladesh, and the 2017 Wannacry ransomware outbreak. Pyongyang has called such allegations part of Washington's attempts to smear its image. For now, the AstraZeneca claims rest on anonymous sources, with no confirmation from the company or any government.