North Korea is continuing with its military provocations. 

Starting with its missile launch at the break of 2023, North Korea has fired missiles on more than 20 occasions so far this year. But the country is posing an even graver threat. 

North Korea is frequently carrying out hacking operations in cyber space. It attempted to launch a malicious cyber attack targeting the South Korea-U.S. combined military exercise that was held last month. What kinds of groups are responsible for North Korea’s hacking attacks and why is the country resorting to cyber operations? 

Today, we’ll analyze North Korea’s hacking groups with Professor Jeong Eun Chan at the National Institute for Unification Education. 

The South Korean government announced unilateral sanctions on a North Korean hacking group called “Kimsuky” on June 2, two days after North Korea launched a projectile carrying its military reconnaissance satellite. 

Significantly, the measure marks the world’s first unilateral sanctions against the North Korean hacking group. What is “Kimsuky” and why did the Seoul government take such action? 

Since 2010, the Kimsuky group has launched hacking attacks on South Korean government agencies and relevant organizations, including the Ministry of National Defense and the Ministry of Unification. 

“Kimsuky” was named by a Russian security firm, while it was tracking a cyber attack by hackers seemingly based in North Korea. The group is notorious for its hacking attack on Korea Hydro & Nuclear Power in South Korea in 2014. Last year, it even impersonated a South Korean National Assembly member to send phishing emails. 

Kimsuky sent emails to foreign affairs and national security experts in the name of the office of Thae Yong-ho, a North Korean diplomat defector-turned-South Korean lawmaker. In doing so, the hacking group monitored online communications and provided the information to the North Korean government. 

Other than Kimsuky, there are many more North Korean hacking groups that steal intelligence through cyber attacks. 

North Korea’s hacking groups belong to the country’s military or the communist party. 15 to 20 hacking teams are known to be working at the Technical Reconnaissance Bureau alone, which is tasked with computer hacking. 

The Lazarus Group, among others, made the international community very nervous. The group hacked into Sony Pictures Entertainment in 2014, in response to the American film company’s movie about the fictional assassination of North Korean leader Kim Jong-un. 

In 2016, Lazarus hacked 101 million dollars deposited at the Federal Reserve Bank of New York account belonging to Bangladesh’s central bank and stole 81 million dollars. These incidents show North Korea’s hacking capabilities have reached a significant level. The country continues to use intelligent and advanced hacking methods. 

In terms of hacking ability, experts evaluate that North Korea ranks third in the world, following the U.S. and Russia. It is assumed that North Korean hacking groups have launched cyber attacks in at least 29 countries for the last 14 years. Apart from the high number of attacks, North Korea’s hacking schemes are widespread, regardless of areas, such as subways, aerospace, nuclear energy and bio-related industries. The purpose is to steal information and disrupt society. In 2021, Reuters reported that North Korean hackers secretly breached computer networks at a missile developing company in Russia, which is North Korea’s traditional ally. 

North Korea is a communist dictatorship that is isolated from the outside world. It is known as an impoverished state suffering from the lack of goods. However, the country’s hacking units relentlessly infiltrate computer systems all around the world. How is that possible? 

Since the years of former leader Kim Jong-il, North Korea has intensively fostered hackers, in the belief that hacking is the most effective means of attack, considering the initial cost of investment. 

Former leader Kim Jong-il instructed officials to provide IT education to gifted children at the national level. Talented students selected from elementary schools nationwide receive extensive computer education, including algorithm design and programming, at schools for science prodigies. Among them, excellent students are admitted to university to learn more advanced skills. North Korean students have actually proved their outstanding computer programmer skills at international competitions. 

North Korean university students who are raised as cyber warriors receive overseas training in China or Russia. When the training is over, they are deployed to hacking units to participate in North Korea’s global cyber operations. So, why is the North nurturing hackers at the state level? 

North Korea operates hacking units to raise funds and gather intelligence for regime maintenance. It created a new phrase “cyber foreign currency income” in 2015, indicating that its hackers are engaging in all sorts of illegal activities as an important means of earning foreign currency. The issue of North Korea’s cryptocurrency thefts was mentioned by U.S. officials during a recent congressional hearing. 

 

Democratic politician Elizabeth Warren said that North Korean hackers have raised over three billion dollars from crypto heists over the past five years. About 50 percent of them are assumed to have been used to procure parts needed for nuclear and missile development. 

Amid the prolonged international sanctions and economic difficulties, North Korea is likely to boost its hacking capabilities even further. 

Kim Jong-un once stressed that cyber warfare, along with nuclear weapons and missiles, is an all-purpose sword that guarantees the North Korean People’s Armed Forces’ striking ability. As the leader’s remarks indicate, North Korea uses its cyber capabilities to steal confidential information as well as assets from other countries. 

The international community needs to seek closer cooperation and make greater efforts to prevent state-sponsored North Korean hackers from engaging in illicit cyber activities.