AlienVault said it found evidence of malware that took over a person's computer and mined monero. The mined currency was then sent back to Kim Il Sung University in Pyongyang. North Korea has been hit by sanctions from the United Nations and by countries including the U.S. "Cryptocurrencies could provide a financial lifeline to a country hit hard by sanctions," the researchers said in a blog post. "Therefore, it's not surprising that universities in North Korea have shown a clear interest in cryptocurrencies." There have been other incidents of North Korean attackers mining monero. A group called Andariel took over a server at a South Korean company last year and used it to mine the cryptocurrency.

Monero is a cryptocurrency built on a different blockchain to bitcoin. The blockchain is the underlying technology behind cryptocurrencies. These blockchains are public ledgers of activities that show all the transactions on a network. But monero's blockchain is purposely made to be more obscure. It works by obfuscating the so-called wallet addresses that people are sending monero from, making it more anonymous.

The increased anonymity that the developers of monero claim exists could be a reason it has been so favored by North Korean actors. Monero's website also claims that it is "safe from capital controls" or measures that restrict the outflow of traditional currencies, much like the North Korean won. Given that sanctions have hit North Korea, monero could be an alternative currency. Also, the time it takes for a monero transaction to take place is 21 minutes. For bitcoin, this rises to more than an hour and a half, and on any given day could be several hours.