Suspected North Korean Hackers Targeted AstraZeneca's Covid Vaccine Work, Sources Say

The approach came the way a career pitch usually does: a message from a recruiter on LinkedIn or WhatsApp, a job on offer, a document attached. According to two people with knowledge of the matter who spoke to Reuters, that is how suspected North Korean hackers have tried in recent weeks to get inside AstraZeneca, the British drugmaker now racing to deploy its Covid-19 vaccine.

The sources said the supposed recruiters sent AstraZeneca staff files presented as job descriptions. The files were laced with malicious code meant to give the hackers access to a victim's computer. One source said the effort reached a "broad set of people," including employees working on Covid-19 research. The attempts are not thought to have succeeded.

Neither side has said anything on the record. AstraZeneca, which has emerged as one of the top three Covid-19 vaccine developers, declined to comment. The North Korean mission to the United Nations in Geneva did not respond to a request for comment, and Pyongyang has no direct line of contact for foreign media. It has previously denied carrying out cyberattacks.

The sources, who requested anonymity because the information is not public, said the tools and techniques used showed the attempts belonged to an ongoing hacking campaign that U.S. officials and cybersecurity researchers have attributed to North Korea. Three people who have investigated the attacks said that campaign had earlier concentrated on defence companies and media organisations, then pivoted to Covid-related targets in recent weeks. One source added that some accounts used against AstraZeneca were registered to Russian email addresses, a possible attempt to mislead investigators.

The episode fits a wider pattern. Cyberattacks on health bodies, vaccine scientists and drugmakers have soared during the pandemic, as state-backed and criminal groups scramble for the latest research and information about the outbreak. Western officials say stolen material could be sold for profit, used to extort victims, or hand foreign governments a strategic advantage in fighting a disease that has killed 1.4 million people worldwide.

Other companies have reported similar activity. Microsoft said this month that two North Korean hacking groups had targeted vaccine developers in multiple countries, including by "sending messages with fabricated job descriptions." It did not name the organizations. On Friday, South Korean lawmakers said the country's intelligence agency had foiled some of those attempts. Reuters has also previously reported that hackers from Iran, China and Russia tried to break into leading drugmakers and even the World Health Organisation this year; Tehran, Beijing and Moscow have all denied the allegations.

North Korea has a long record in the eyes of U.S. prosecutors, who have blamed it for some of the most audacious and damaging cyberattacks on record. These include the hack and leak of Sony Pictures emails in 2014, the theft of $81 million from the Central Bank of Bangladesh in 2016, and the Wannacry ransomware outbreak in 2017. Pyongyang has described such allegations as part of Washington's attempts to smear its image.

For now, the attribution to North Korea rests on anonymous sources and technical assessments rather than any public confirmation, and the reported attempts on AstraZeneca appear to have failed.