4.4 million attacks from North Korean IPs put focus on Pyongyang’s cyber capabilities

More than 4.4 million attempts to access South Korean financial systems from North Korean IP addresses have been detected, throwing Pyongyang’s growing cyberwarfare capabilities into focus.

Analysts say Pyongyang uses cyberspace both as a battlefield for intelligence warfare and as a way around international sanctions, mobilizing dedicated hacking groups to raise funds for the regime and steal military and diplomatic intelligence.

Financial authorities recently sent financial companies and cryptocurrency exchanges a notice through FIRST, the financial sector’s integrated security monitoring system. According to the authorities, 4,404,101 attempts to probe financial systems were detected from multiple IP addresses assigned to North Korea from 3 a.m. on Oct. 21 until the notice was sent. It is the first time signs of access from North Korean IPs have been confirmed as a string of financial sector hacking incidents hit the sector this month.

Because IP addresses can be spoofed or rerouted, it is difficult to conclude that North Korea was behind the attempts. It has also not been confirmed whether any of them led to an actual breach or data theft. Experts nonetheless say the North’s cyberattack capabilities have reached a significant level.

The Reconnaissance General Bureau is considered the key agency overseeing North Korea’s cyberwarfare. South Korea, the United States and the international community have identified hacking groups including Lazarus, Andariel and Kimsuky as operating under or in connection with the bureau. Lazarus is believed to focus on stealing funds from financial institutions and cryptocurrency exchanges, Andariel on infiltrating the defense and technology sectors and Kimsuky on gathering diplomatic and security intelligence.

Lazarus was blamed for the 2014 hacking of Sony Pictures in the United States over the film "The Interview" (2014) and the 2016 hacking of Bangladesh’s central bank. The South Korean government has placed Lazarus under its own cyber-related sanctions on North Korea. The U.S. blockchain analysis firm Chainalysis estimated in a report late last year that North Korea-linked hacking groups stole about $2.02 billion in cryptocurrency last year.

North Korea has also poured state resources into training cyber specialists. South Korea’s National Intelligence Service (NIS) and Joint Chiefs of Staff estimated that the North had about 8,400 cyberwarfare personnel as of 2024. The North has built up its capabilities by selecting talented students in math and information technology at an early age for intensive training and sending some of them overseas.

Its methods are also becoming more sophisticated. Beyond traditional attacks using malicious emails and disguised documents, signs have recently emerged that the North is developing AI-powered tools to automate attacks. That has raised concerns that North Korean cyberattacks could become more frequent and sophisticated.

North Korea favors cyberwarfare because it yields enormous economic and military gains at relatively low cost. Cyberattacks let the regime earn foreign currency while bypassing international sanctions and steal other countries’ security and military secrets at the same time. North Korean leader Kim Jong-un has called cyberwarfare an “all-purpose sword” that, along with nuclear weapons and missiles, supports the country’s military strike capabilities, according to the NIS.

“North Korea’s cyber capabilities, combined with AI, are emerging as a means that could threaten national security as a whole,” said Jung Yu-seok, a research fellow at the Korea Institute for National Unification. “A systematic, national-level response is needed.”

BY CHUNG YEONG-GYO [[email protected]]