South Korea recently took action against 15 North Korean individuals and an organization for engaging in cybercrimes that include major cryptocurrency thefts. This decision underscores growing unease regarding North Korea’s use of cyberspace to support its weapon programs and bypass global sanctions.
Crackdown on North Korean Cybercriminals and IT Experts
South Korean Ministry of Foreign Affairs revealed that those facing sanctions are associated with Bureau 313, an arm of North Korea’s Workers’ Party of Korea’s Machine-Building Industry Department which manages weapons manufacturing (including ballistic missile development ) as well as ballistic missile launches. Designated under United Nations Security Council sanctions since 2016, Bureau 313 plays an essential role in North Korean armament efforts.
China, Russia, Southeast Asia and Africa all host sanctions-laden individuals who reportedly operate under false identities to gain employment within IT companies. Many conduct activities such as network infiltration and manipulation, often leading to cryptocurrency thefts – the case of Kim Cheol-min is notable – it’s suspected he penetrated US and Canadian IT firms to redirect substantial amounts of foreign currency back to North Korea via currency thefts; moreover, another sanctioned entity allegedly dispatched North Korean IT experts abroad in order to amass illicit funds which supported both regime and military ambitions of Pyongyang.
Surge in Crypto Thefts and Cyber Espionage
Recent findings by blockchain analytics company Chainalysis demonstrate the justification for these sanctions: North Korean hackers were responsible for more than $1.34 billion worth of cryptocurrency theft over 47 instances last year – this constitutes 61% of all global cryptocurrency theft in 2023, representing both frequency and scale increases of theft operations by North Koreans.
These attacks are highly sophisticated, employing advanced tactics to gain entry to corporate networks and seize digital assets. One particularly alarming trend involves North Korean IT personnel infiltrating global tech and Web3 companies by using fake identities and remote work opportunities to breach security protocols while misappropriating funds through complex blockchain transactions that mask their trail.
South Korea has pledged its vigilance and coordination with international bodies to counter North Korea’s illegal cyber activities, with new sanctions required of any financial or foreign exchange dealings with identified individuals and entities prior approval from South Korean authorities. They are set to come into effect starting December 30, upon publication in the Official Gazette.
