North Korea Stole 2 Trillion Won in Virtual Assets Last Year…Largest Hacking Ever

North Korea Stole 2 Trillion Won in Virtual Assets Last Year…Largest Hacking Ever

From Deepfake Employment to Supply Chain Infiltration…North Korea's Hacking Methods Becoming More Sophisticated

NIS "New Types of Attacks Confirmed, Including Remote Smartphone Reset"

It has been revealed that North Korea stole virtual assets worth over 2 trillion won last year, the largest amount ever.

◇ From Document Management Solution Infiltration to Deepfake Employment…North Korea's Hacking Sophistication

On the 10th, the National Cyber Security Center (NCSC) of the National Intelligence Service (NIS) published its annual report summarizing the cyber threat situation and response activities last year.

North Korea is engaged in technology theft and large-scale financial extortion in various fields such as defense and information technology (IT).

North Korean organizations exploited vulnerabilities in three types of domestic document management solutions to create administrator accounts and steal data.

It is reported that the sensitive data leaked in this process ranged from a minimum of 700 to a maximum of 2.6 million cases.

North Korea's hacking group Andariel infiltrated the computer network of infrastructure through an IT maintenance company, occupied more than 20 servers, and stole core data such as blueprints.

In particular, in terms of attack methods, hacking techniques were confirmed where identities were disguised through video interviews using deepfakes or by infiltrating open-source supply chains to gain false employment at overseas IT companies.

Also, new methods previously unseen emerged, such as remotely resetting smartphones to disable security responses.

It is estimated that North Korea stole over 2 trillion won in virtual assets last year alone using these techniques.

◇ Government Promotes Cyber 119 and Post-Quantum Cryptography…N2SF System Also Full-Fledged

To respond to these threats, the government launched Cyber 119, a nationwide response organization, in August 2024.

This organization divided the country into five regions, including the Seoul metropolitan area and Yeongnam region, and deployed more than 130 experts from a total of 46 institutions, enabling initial response to large-scale hacking or network paralysis incidents.

The government also implemented the National Network Security Framework (N2SF), which applies differentiated security controls (confidential, sensitive, public) based on data importance, laying the groundwork for safe use of new technologies such as generative AI and cloud in the public sector.

Preparations for future security areas such as space and quantum are also accelerating.

Cybersecurity guidelines for space systems have been established, and four types of Korean post-quantum cryptography to prepare for the threat of quantum computers have been finally selected.

The government is pursuing a comprehensive roadmap to transition the national cryptographic system to post-quantum cryptography by 2035.

The National Cyber Security Center stated, "The large-scale personal information leaks and government network paralysis incidents experienced last year show that cyber threats can directly lead to physical damage," adding, "We will continue to proactively respond to threats using AI and new technologies to build a digital environment where citizens can feel safe."