South Korea takes action against North Korean cybercriminals

South Korea has stepped up efforts to curb illegal cyber operations by its northern neighbor, the Democratic People’s Republic of Korea (DPRK), which have increased to alarming levels.

These activities, which include cryptocurrency theft and IT-related currency generation, are said to fund Pyongyang’s nuclear and missile programs.

Cryptocrimes that finance military developments

in a press statement Posted on Boxing Day, the South Korean government announced that it had designated 15 North Korean IT employees and one organization under separate sanctions.

The individuals allegedly belong to the 313th General Office, an entity linked to the DPRK Ministry of Munitions Industry, which oversees the country’s weapons development programs.

Among them, Kim-Cheol-Min is accused of secretly working for technology companies in the United States and Canada, funneling large sums of money to the North Korean regime. Another individual, Kim Ryu-Sung, had previously faced prosecution in the United States for violating sanctions.

The measures will also target the Chosun Geumjeong Economic Information Technology Exchange Company, which reportedly sends IT workers abroad to help generate foreign currency for North Korea. The money is reportedly used to fund military developments in the pariah nation.

Once the sanctions take effect on December 30, 2024, South Korean law requires that any financial transactions with affected individuals and entities must receive approval from the Financial Services Commission or the Governor of the Bank of Korea.

Growing North Korean threat

The restrictions against suspected DPRK agents come even as a recent Chainalysis report revealed that North Korean actors were responsible for 61% of the $2.2 billion stolen in 2024 in cryptocurrency heists worldwide. The hackers used sophisticated tactics, including the implementation of malware and social engineering, that allowed them to attack major digital asset companies.

In one case, decentralized finance (DeFi) platform Radiant Capital suffered a $50 million hack attributed to North Koreans. The attackers orchestrated the breach using malware distributed through Telegram, exploiting weaknesses in the platform’s security.

Additionally, the notorious hacking outfit, Lazarus Group, has been linked to another $50 million heist, this time on the Upbit crypto exchange. South Korean authorities, working with the FBI and Swiss prosecutors, confirmed the group’s involvement and shed light on its links to the DPRK’s main intelligence agency, the Reconnaissance General Bureau.

Kaspersky Labs security analyst Vasily Berdnikov also connected the syndicate to an elaborate hacking plot that involved cloning a popular blockchain game and embedding malicious code into its website, allowing it to install malware on the systems of anyone who played it. .

Meanwhile, US authorities have been addressing related issues. On December 17, Treasury’s Office of Foreign Assets Control (OFAC) sanctioned two individuals and one entity for allegedly laundering millions of dollars in cryptocurrency for Kim Jong Un’s administration.