iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On September 6, 2018, the U.S. Department of Justice announced that a federal criminal complaint against North Korean programmer Park Jin Hyok had been unsealed. Prosecutors charged him with one count of conspiracy to commit computer fraud and abuse and one count of conspiracy to commit wire fraud. The complaint alleged that Park worked for Chosun Expo Joint Venture (also called Korea Expo Joint Venture or KEJV) and participated in a North Korean government-sponsored hacking team that private-sector researchers call the Lazarus Group.
The filing connected the alleged conspiracy to the 2014 Sony Pictures Entertainment attack, the malware used in the 2017 WannaCry 2.0 attack, the 2016 Bangladesh Bank theft and other intrusions. These were allegations in a criminal complaint, not a court finding of guilt. The U.S. Attorney’s Office said Park was presumed innocent unless and until proven guilty.
What charges did Park Jin Hyok face?
The complaint, filed in the U.S. District Court for the Central District of California on June 8, 2018 and unsealed on September 6, alleged two conspiracies:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
| Count | What it means in the DOJ announcement | Maximum statutory penalty cited by prosecutors |
|---|---|---|
| Conspiracy to commit computer fraud and abuse | An alleged agreement to carry out unauthorized or harmful computer activity | Up to five years in prison |
| Conspiracy to commit wire fraud | An alleged scheme using electronic communications to obtain money or property by fraud | Up to 20 years in prison |
Those figures were statutory maximums, not a prediction of a sentence. A charge is an accusation, and the government still would have had to prove its case in court.
What did prosecutors allege about the attacks?
Sony Pictures Entertainment
The complaint described the November 2014 attack on Sony Pictures as part of the alleged conspiracy. The attack was destructive and was associated with the film The Interview. Separately, on December 19, 2014, the FBI publicly said its investigation found the North Korean government responsible for the Sony attack, citing technical links between the destructive malware and malware previously developed by North Korean actors.
#1 Best Overall
The FBI’s public attribution and the later complaint are related but distinct government actions. The FBI statement attributed the incident to North Korea; the 2018 complaint alleged that Park was an individual participant in a wider conspiracy. Neither statement by itself constituted a criminal conviction.
WannaCry 2.0
According to the DOJ, the alleged conspiracy included development of malware used in the May 2017 WannaCry 2.0 attack. Prosecutors said WannaCry infected hundreds of thousands of computers worldwide and significantly affected the United Kingdom’s National Health Service. The complaint’s allegation concerned Park’s supposed role in developing or supporting the malware; it did not establish guilt through a verdict.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
Bangladesh Bank theft
The DOJ identified $81 million as the amount stolen from Bangladesh Bank in 2016. Prosecutors connected that theft to the same alleged network of North Korean activity. The $81 million figure is the government’s stated amount for that incident, not a finding that Park personally received or retained those funds.
Other intrusions
The complaint also described additional attacks and attempted thefts. Prosecutors presented Sony, WannaCry, Bangladesh Bank and the other incidents as parts of a broader alleged campaign rather than as separate convictions already established in court.
How did investigators say they linked Park to the activity?
The DOJ said investigators followed several overlapping indicators instead of relying on a single computer address or account. The complaint described:
- Connected email and social-media accounts, including accounts used under aliases.
- Credential-collection accounts used to obtain login information.
- Common malware code libraries and similarities in malicious software.
- Proxy services used to route or conceal connections.
- IP addresses and related infrastructure appearing across the investigated activity.
These categories describe the government’s claimed investigative links. They were evidence allegations in the complaint, not an independent judicial determination that every connection proved Park’s identity or intent.
What are Chosun Expo, KEJV and Lazarus Group?
Prosecutors alleged that Park worked for Chosun Expo Joint Venture, also known as Korea Expo Joint Venture or KEJV. The complaint further alleged that he belonged to a North Korean government-sponsored hacking team known among private-sector researchers as the Lazarus Group. “Lazarus Group” is a researcher and industry label; the DOJ used it to describe the alleged network in the charging narrative, not as a separate legal entity named in a conviction.
2014 attribution versus the 2018 complaint
| Event | What the government said | Legal significance |
|---|---|---|
| December 19, 2014 | The FBI publicly attributed the Sony Pictures attack to the North Korean government. | Public national-security attribution; not a criminal judgment against Park. |
| June 8, 2018 | The criminal complaint against Park was filed in Los Angeles federal court. | Formal charging document containing allegations. |
| September 6, 2018 | DOJ unsealed the complaint, announced the two conspiracy counts and announced sanctions against Park and KEJV. | Public disclosure of the allegations and government action. |
| February 17, 2021 | DOJ announced a later indictment involving Park and two additional North Korean defendants, describing it as an expansion of the 2018 case. | The materials available for this report do not establish the case’s eventual adjudication or current procedural status. |
What U.S. officials said in 2018
FBI Director Christopher Wray said in the DOJ’s September 6, 2018 release: “Today’s announcement demonstrates the FBI’s unceasing commitment to unmasking and stopping the malicious actors and countries behind the world’s cyberattacks.”
Cybersecurity official Jeanette Manfra described public “naming and shaming” as one deterrence measure among other government actions. Treasury Secretary Steven Mnuchin said, in remarks quoted at the time, “The United States is committed to holding the regime accountable for its cyber-attacks and other crimes and destabilizing activities.” Both comments were made in the 2018 policy context and were statements by the officials quoted, not judicial findings.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is known about the case now?
The February 17, 2021 DOJ announcement said a later indictment added two North Korean defendants and expanded the earlier case. The sources available here do not establish whether Park was tried, convicted, acquitted or otherwise brought to a final adjudication. The legally accurate description is therefore that he was charged and accused, while remaining presumed innocent unless and until proven guilty.
Quick Recap
Why the wording matters
- “North Korea was attributed responsibility” refers to the FBI’s 2014 public statement about the Sony attack.
- “Park was charged” refers to the two conspiracy counts announced after the complaint was unsealed in 2018.
- “Park carried out the attacks” would state an adjudicated fact that the cited materials do not establish.
- “WannaCry was ransomware” describes the malware’s function, while the complaint’s legal allegation concerned Park’s supposed role in developing or supporting it.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
