{"id":4592,"date":"2025-04-25T17:33:23","date_gmt":"2025-04-25T17:33:23","guid":{"rendered":"https:\/\/nationalgunowner.org\/index.php\/2025\/04\/25\/how-north-korea-became-a-cybercrime-superpower-without-internet-access\/"},"modified":"2025-04-25T17:33:33","modified_gmt":"2025-04-25T17:33:33","slug":"how-north-korea-became-a-cybercrime-superpower-without-internet-access","status":"publish","type":"post","link":"https:\/\/nationalgunowner.org\/index.php\/2025\/04\/25\/how-north-korea-became-a-cybercrime-superpower-without-internet-access\/","title":{"rendered":"How North Korea Became a Cybercrime Superpower Without Internet Access"},"content":{"rendered":"
\n
North Korea\u2019s hacker army, operating under the regime\u2019s spy agency, has become one of the world\u2019s most dangerous digital threats\u2014funding nuclear ambitions with stolen crypto and state-backed cybercrime. NurPhoto via Getty Images<\/span><\/figcaption><\/figure>\n

How does a country become a hacking superpower when it\u2019s barely connected to the internet? It\u2019s easy when you\u2019re North Korea.<\/span><\/p>\n

\n<\/section>\n

The average North Korean can\u2019t access the internet; most online activity is conducted via the repressive regime\u2019s nationwide intranet, termed <\/span>Kwangmyong<\/span><\/a>, which is monitored by the secret police. The relatively few North Koreans who are permitted access to the open internet, which requires special authorization, are even more tightly watched by the regime. <\/span>Such restrictions haven\u2019t stopped Pyongyang from becoming a full-fledged cybercriminal regime. All over the world, adept North Korean hackers are leading efforts to crack into sensitive IT systems, ranging from banks to governments to businesses of every kind.<\/span><\/p>\n

This comes as no surprise, since North Korea has financed itself with international criminal proceeds for decades. For want of much of any legitimate economy, outside arms sales (these have <\/span>become important<\/span><\/a> to Russia\u2019s war against Ukraine recently), the Democratic People\u2019s Republic of Korea opted for stealing and selling illegal products globally. <\/span><\/p>\n

A couple decades ago, North Korean representatives were engaged in a wide array of lucrative criminal activity abroad. Drug-dealing is a longtime cash-cow for Pyongyang, with pervasive sales of illegal narcotics, especially ecstasy and methamphetamine, on an <\/span>industrial scale<\/span><\/a>. Counterfeiting is another venue for North Korean state-sanctioned crime, <\/span>all over the world<\/span><\/a>. The DPRK\u2019s outsized <\/span>embassy in Vienna<\/span><\/a> has long served as a front for counterfeiting and other financial crimes across Europe. <\/span>However, hacking has outpaced all the regime\u2019s other criminal campaigns for its ease and profitability. North Korea\u2019s acumen in cyber-theft stunned the world two months ago when Pyongyang\u2019s hackers pillaged Bybit<\/a>, a Dubai-based firm claiming to be the world\u2019s second-largest cryptocurrency exchange, with 40 million users. DPRK hackers made off with $1.5 billion in crypto, the <\/span>biggest online heist<\/span><\/a> in history.<\/span><\/p>\n

This sophisticated hack exploited vulnerabilities in Bybit\u2019s multi-signature wallet system, which was enabled by compromised infrastructure at Safe{Wallet}, a third-party provider. These North Korean hackers are known as the Lazarus Group<\/a>, also as APT38, and they\u2019re savvy criminals whose online thefts since 2020 have targeted cryptocurrency providers employing a cunning series of malicious applications known to the Federal Bureau of Investigation as \u201c<\/span>TraderTraitor<\/span><\/a>.\u201d The FBI, backed by U.S. cyber intelligence, knows that the Lazarus Group is, in fact, North Korea\u2019s intelligence services, specifically the Reconnaissance General Bureau, the regime\u2019s foreign spy agency.<\/span><\/p>\n

Pyongyang wasted no time cashing in on its record-breaking haul by <\/span>laundering some $300 million of the stolen crypto<\/a> through myriad fronts in just two weeks. North Korea\u2019s online criminals are just as adept at laundering the proceeds of cybercrime as they are at stealing it in the first place. It\u2019s unlikely that most of the stolen crypto will ever be returned, despite persistent international efforts to do so.\u00a0<\/span><\/p>\n

The Bybit hack was a wake-up call to the online business world. Pyongyang isn\u2019t slowing down its cyber theft operations, which provide badly needed cash for the regime, including to finance its nuclear weapons program. This week brings <\/span>news<\/span><\/a> that the Lazarus Group\u2014the RGB\u2014has been busy in the United States, attempting to steal cryptocurrency. In an audacious move, APT38 created two businesses in this country as fronts to infect developers working in the cryptocurrency industry with malicious software. These firms, <\/span>Blocknovas LLC<\/span><\/a> and Softglide LLC<\/span><\/a> were set up in New Mexico and New York states, respectively, using fake personas and addresses. A third business, Angeloper Agency<\/a>, is linked to the campaign, but does not appear to be registered in the U.S. This was a crime from the start, since it violates U.S. Treasury sanctions on the North Korean regime\u2019s international financial operations.<\/span><\/p>\n

This latest RGB gambit employs online spy tradecraft that Pyongyang\u2019s using widely. These days, DPRK cyber operatives, including <\/span>the Lazarus Group<\/span><\/a>, routinely use aliases and fake profiles <\/span>via LinkedIn<\/span><\/a>, hoping to get hired by American and other Western firms, in order to steal from them. Firms in numerous countries, especially the United States and Great Britain, including <\/span>dozens of Fortune 100 companies<\/span><\/a>, have mistakenly hired North Korean IT workers, in actuality, cyber spies, who have posed under fake names and resumes. Although the FBI and the Justice Department are <\/span>cracking down aggressively<\/span><\/a> on these DPRK \u201claptop farms,\u201d such mitigation efforts are barely scratching the surface of North Korea\u2019s cyber threat to the world.<\/span><\/p>\n

There\u2019s no chance that Pyongyang will pull back from its online pillaging of other countries, especially the United States. The gains are enormous, while the risks of serious punishment are modest. What can Washington, DC, realistically do to punish a country that barely operates in the legitimate global economy? It\u2019s therefore imperative for American firms to keep vigilant watch over whom they\u2019re interacting with online. That African IT specialist you just hired at a bargain rate, to virtually assist with your latest software upgrade, may really be a North Korean spy preparing to rob your business blind.<\/span><\/p>\n

There\u2019s palpable irony here. As North Korea steals billions of dollars online, all over the world, the proceeds of its vast cybercrime spree are directed to the regime and its leaders. In the meantime, Pyongyang <\/span>has ordered<\/span><\/a> schools nationwide to establish rabbit pens to help raise cheap protein for the military, which is short of food. Officials whose schools don\u2019t meet at least the thousand-rabbit quota face regime punishment\u2014stolen crypto cash for some, bunny sandwiches for others, depending on your connections to party bigwigs.<\/span><\/p>\n

John R. Schindler served with the National Security Agency as a senior intelligence analyst and counterintelligence officer.<\/span><\/i><\/p>\n

\t\t\t\t\"North<\/p><\/div>\n