North Korea's growing criminal cyberthreat

The countries posing the greatest cyberthreats to the United States are Russia^[1], China^[2], Iran^[3] and North Korea. Like its counterparts, Kim Jong Un’s regime engages in substantial cyber espionage. And like Russia and Iran, it launches damaging cyberattacks that wipe data from computer disks and shut down online services.

But the North Korean cyberthreat is different in two ways. First, the regime’s online power did not grow out of groups of independent hackers. Even today, it seems unlikely the country has hackers who operate independent of the government. Second, North Korea’s cybercrime efforts – all seemingly state-sponsored – steal money that is then used to fund its cash-strapped government.

Government-controlled hacking

One reason for North Korea’s apparent lack of independent hackers is that most North Koreans do not have internet access. Although the country has had an internet connection through China^[4] for several years, it’s reserved^[5] for elites and foreign visitors. Would-be hackers can’t launch attacks across borders; they can’t even pick up hacking manuals, code and tips from the many online forums that other hackers in other nations use to learn the trade and share information.

On top of that, North Korea maintains exceptionally strong controls over its population. Any hacking attributed to North Korea is likely done for the government if not by the government directly.

State-sponsored hackers

North Korea’s cyber warriors^[6] work primarily for the General Bureau of Reconnaissance or the General Staff Department of the Korean People’s Army. Prospective candidates are selected from schools across the country and trained in cyber operations at Pyongyang University of Automation^[7] and other colleges and universities. By 2015, the South Korean military estimated the KPA employed up to 6,000 cyber warfare experts^[8].

North Korean hackers operate from facilities in China and other foreign countries^[9] where their government sends or permits them to work. Indeed, the country has reportedly sent hundreds of hackers into nearby countries to raise money^[10] for the regime. Many of the cyberattacks attributed to North Korea have been traced back to locations inside China^[11].

From espionage to sabotage

North Korea has been using cyber operations to spy on^[12] the U.S. and South Korea since at least 2004. U.S. targets have included military entities^[13] and the State Department. North Korea uses cyber espionage to acquire foreign technology, including technologies relating to weapons^[14] of mass destruction, unmanned aerial vehicles and missiles.

By 2009, North Korea had expanded its cyber operations to include acts of sabotage. The first of these took place in July 2009^[15], when massive distributed denial of service (DDoS) attacks shut down targets in the U.S. and South Korea. The attackers also used “wiper” malware to delete data on disks.

North Korea has continued to launch DDoS and disk-wiping attacks^[16] over the years, targeting banks as well as other military and civilian systems in the U.S. and South Korea. A cyberattack in April 2011 against South Korea’s agricultural banking cooperative Nonghyup was said to shut down the bank’s credit card and ATM services^[17] for more than a week.

In December 2014, the North’s attackers hit desktop computers in a South Korean nuclear plant^[18] with wiper malware that destroyed not only the data on hard drives, but also the master boot record startup software, making recovery more difficult. In addition, the attack stole and leaked blueprints and employee information from the plant.

North Korea has also been accused of trying to hack electric power companies^[19] in the U.S. and a railroad system^[20] in Canada.

The attack on Sony

The attack on the nuclear facility took place about a month after North Korea attacked Sony Pictures^[21] with wiper malware that zapped over 4,000 of the company’s desktop computers^[22] and servers. The attackers also stole and posted pre-release movies and sensitive, often embarrassing, emails^[23] and other data taken from the company.

Calling themselves the “Guardians of Peace,” the attackers demanded that Sony withhold release of the satirical film “The Interview^[24],” which depicts an assassination attempt against North Korea’s leader, Kim Jong-un. The attackers also threatened violence^[25] against any movie theaters showing the film.

Although theaters initially canceled their scheduled showings, ultimately the film was released^[26] both online and in theaters. North Korea’s coercive attempts^[27] failed, as they have in other cases.

Financial crimes

In recent years, North Korea started using cyber operations^[29] to generate revenue for the government. This is done through several illicit means, including outright theft of funds, extortion and cryptocurrency mining^[30].

In early 2016, the regime came close to stealing US$951 million from the Bangladesh Central Bank^[31] over the global SWIFT financial network. Fortunately, because of a misspelling, they only succeeded in moving $81 million. Analysts attributed the attack to the “Lazarus Group^[32],” the same group believed to be behind many of the attacks tied to North Korea, including those against Sony and other banks.

The Lazarus Group has also been blamed^[33] for the WannaCry^[34] ransomware that spread to computers in 150 countries in 2017. After encrypting data on a victim’s computer, the malware demanded payment in the bitcoin digital currency to get access back.

North Korea has been mining cryptocurrencies^[35] on hacked computers as well. The hijacked machines run software that “earns” the digital currency by performing a computationally difficult task. The funds are then directed into an account tied to the hackers.

North Korean hackers also attack cryptocurrency exchanges^[36]. They have reportedly stolen millions of dollars^[37] worth of bitcoin from two exchanges in South Korea and attempted thefts from 10 others.

A cybercrime power

Like other countries, North Korea uses cyber espionage and cyber sabotage to acquire secrets and harm adversaries. But it stands out from other countries in its use of cybercrime to finance^[38] its programs. This is perhaps not surprising given North Korea’s history of counterfeiting^[39] U.S. currency and using other illicit activities^[40] to acquire funds.

The introduction of online transactions and digital currencies, coupled with inadequate cybersecurity, has opened the doors to North Korea for illicitly acquiring funds by new means. Given the country’s appetite for building nuclear and other weapons, as well as the effects of economic sanctions, it seems likely that North Korea will continue to seek ways of exploiting the cyber world for economic advantage.

References

1. ^{^} Russia (theconversation.com)
2. ^{^} China (theconversation.com)
3. ^{^} Iran (theconversation.com)
4. ^{^} internet connection through China (arstechnica.com)
5. ^{^} it’s reserved (fas.org)
6. ^{^} cyber warriors (www.keia.org)
7. ^{^} Pyongyang University of Automation (www.zdnet.com)
8. ^{^} up to 6,000 cyber warfare experts (www.telegraph.co.uk)
9. ^{^} China and other foreign countries (www.keia.org)
10. ^{^} raise money (www.bloomberg.com)
11. ^{^} traced back to locations inside China (www.reuters.com)
12. ^{^} to spy on (faculty.nps.edu)
13. ^{^} military entities (www.nytimes.com)
14. ^{^} technologies relating to weapons (money.cnn.com)
15. ^{^} took place in July 2009 (www.csmonitor.com)
16. ^{^} launch DDoS and disk-wiping attacks (www.symantec.com)
17. ^{^} shut down the bank’s credit card and ATM services (www.reuters.com)
18. ^{^} nuclear plant (www.trendmicro.com)
19. ^{^} hack electric power companies (www.nbcnews.com)
20. ^{^} railroad system (www.thestar.com)
21. ^{^} Sony Pictures (fortune.com)
22. ^{^} over 4,000 of the company’s desktop computers (www.washingtonpost.com)
23. ^{^} sensitive, often embarrassing, emails (www.theguardian.com)
24. ^{^} The Interview (www.imdb.com)
25. ^{^} threatened violence (www.theguardian.com)
26. ^{^} the film was released (deadline.com)
27. ^{^} coercive attempts (www.cfr.org)
28. ^{^} AP Photo/Ahn Young-joon (www.apimages.com)
29. ^{^} using cyber operations (motherboard.vice.com)
30. ^{^} cryptocurrency mining (www.thecipherbrief.com)
31. ^{^} Bangladesh Central Bank (www.nytimes.com)
32. ^{^} Lazarus Group (www.cfr.org)
33. ^{^} blamed (www.cnn.com)
34. ^{^} WannaCry (www.csoonline.com)
35. ^{^} mining cryptocurrencies (www.bloomberg.com)
36. ^{^} attack cryptocurrency exchanges (www.scmagazineuk.com)
37. ^{^} stolen millions of dollars (www.scmp.com)
38. ^{^} cybercrime to finance (www.fastcompany.com)
39. ^{^} history of counterfeiting (fas.org)
40. ^{^} illicit activities (www.thedailybeast.com)