Global threat

Experts concerned about North Korea’s cyber power

Experts are concerned that North Korea could form a "cyber war troika" with Russia and China.

(Bild: stock.adobe.com/Grispb)

For a long time, it seemed as if North Korea had put all its efforts into its nuclear weapons program to deter arch-enemies the US and South Korea. But in parallel, the regime in Pyongyang has built up a cyber army that fits seamlessly into the system for maintaining the Stalinist regime. Experts and politicians are worried.

"Military first": that was the doctrine of North Korean ruler Kim Jong-il, who died in 2011. The international community, above all the West, subsequently concentrated on preventing North Korea from developing and manufacturing nuclear weapons, refining its missile technology and increasing missile production. Comprehensive UN military and economic sanctions have not prevented this. In the shadow of the nuclear and missile program, the regime in Pyongyang has built up a cyber phalanx.

Kim Jong-il's son and successor as head of state, Kim Jong-un, has really boosted this weapon of attack, according to Bora Park from the Institute for National Security Strategy (INSS) in Seoul. The government-funded think tank advises the South Korean President's Office, the Ministry of Defense and other ministries as well as the National Security Council on cybersecurity, cyber espionage defense and counter espionage.

As early as the end of the 1960s - still under state founder Kim Il-sung, the father of Kim Jong-il and grandfather of Kim Jong-un - North Korea gradually acquired expertise in the computer sector, and even more so after the turn of the millennium, according to Park.

Cyber warriors: elite unit and social elite
North Korean students, who learned about high technology in friendly countries such as Russia or China and brought their know-how back home, played an important role in this. In 2007, the North Korean military already had a cyber army of around 6000 people at its disposal, according to Park. In North Korea, where there is generally only a state-controlled intranet, the cyber soldiers with access to the World Wide Web form a privileged elite.

Park: "Under the supremacy of the National Defense Commission with dictator Kim as chairman, every security-related authority in North Korea now has a hacker unit. As part of a cyber war against South Korea, they are trying to outdo each other in competition."

Celebrated dictator: Kim Jong-un

(Bild: APA/AFP/KCNA VIA KNS/STR)

Extensive repertoire
The repertoire of the North Korean "state hackers" appears to be extensive: data theft including ransomware, paralyzing or damaging the websites of companies and public bodies, the theft of cryptocurrencies. It also includes money laundering and social division through disinformation campaigns and fake news. In most cases, it is not possible to trace a cyber attack back to specific perpetrators - they are good at covering their tracks online.

The first major cyber attack that South Korea attributes to its communist neighbor almost brought down government websites and the IT infrastructure of financial institutions in 2003. According to Bora Park, this was like a wake-up call. "After that, we developed our own security strategies to defend ourselves and fight back."

This was followed in 2009 by so-called DDos attacks, in which the servers of South Korean government, banking and media sites are flooded with requests in order to bring them down. Hackers from North Korea's military intelligence service are also held responsible for the attack on a crypto exchange in 2019. Tokens of the Ethereum currency worth 41.5 million US dollars were stolen.

Office 39 and Office 21
Such cyber bank robberies fit seamlessly into the cycle of North Korea's deterrence and defense policy. The illegally appropriated funds flow illegally into the arms industry - as does technology captured on the internet. North Korea resells the weapons produced and the technology itself. These proceeds also flow into the system and keep it running, regardless of the UN sanctions.

Another source of income is provided by North Korean IT people who assume false identities and are employed by Western companies. The regime takes almost all of their salaries. In addition to foreign currency, they also supply stolen technology and insider knowledge.

This approach is anything but new: North Korea has reportedly been smuggling cheap labor into European countries illegally and in violation of human rights for a long time. They toil in agriculture or construction, for example, and are paid a pittance.

The leadership of North Korea's all-powerful Workers' Party maintains the so-called Office 39, which uses front companies abroad to procure foreign currency through crimes in the real world - counterfeit money, smuggling, fraud - to finance the luxury life of the state leadership. Office 21 is regarded as a parallel structure for cyberspace.

Russia thwarts UN monitoring
According to official figures from South Korea, North Korea's illegal cyber activities increased by 40 percent from 2022 to 2023. In the theft of cryptocurrencies alone, North Korea is said to have stolen the equivalent of three billion US dollars from 2017 to 2023, one billion of which in the previous year. At the same time, the UN, whose measures have already proven to be toothless when it comes to nuclear weapons and missiles, is even weaker in the face of the cyber threat. The reason for this is Russia's close alliance with North Korea over the war in Ukraine.

A UN committee of experts, which monitored compliance with the sanctions and their effectiveness, has no longer existed since May. Russia had vetoed the extension of the committee. Moscow had previously concluded a comprehensive security agreement with Pyongyang. It includes a mutual defense pact that is particularly important for North Korea. In return, North Korea supplies Russia with ammunition for the war of aggression against Ukraine, including heavy artillery such as self-propelled howitzers and multiple rocket launchers.

Concerns about cyber support in the Ukraine war
This alliance is also raising concerns in Europe. According to Bora Park, South Korea has "no knowledge to date that North Korea has also deployed IT warriors for Russia". However, the bilateral security agreement explicitly provides for this as a possibility. "The probability that North Korea is also sending cyber units to Russia to wage war against Ukraine is therefore high."

There is even greater concern about the scenario that China, South Korea's second largest cyber adversary, could form a "cyber war troika" with Russia and North Korea. "That would make it a bigger global threat," warned South Korea's ambassador to Vienna, Baek Yoon-jeong, at a North Korea conference at the Diplomatic Academy on Tuesday.

INSS expert Park is thinking of her own "cyber sanctions". "But what effective measures there could be is still in its infancy." Hence the tenor at the conference: there is a need for international solidarity and actual cooperation between Western countries against North Korea's web army.