80% of Cyber Threats in South Korea are Linked to North Korea

North Korean authorities have reportedly strengthened their internal hacking infrastructure in anticipation of the upcoming general elections in South Korea in April. Historically, North Korea has provoked during a strained inter-Korean relationship or in the face of major elections. The National Intelligence Service (NIS) plans to prevent damage by preparing for North Korea’s possible attempts to influence public opinion through election system hacking and the dissemination of fake news.

According to the NIS on the 24th, at a meeting held at the National Cyber Security Cooperation Center in Seongnam, it was revealed that “last year, we detected an average of 1.62 million attempts to attack per day by state-sponsored and international hacking organizations targeting the public sector.” This figure is a 36% increase from the previous year, due to the increase in attack attempts targeting numerous public officials and improved capabilities to detect cyber attacks.

North Korea accounted for 80% of the attacks, while China was at 5%. However, when considering the severity of the damage, reflecting the scale of damage of each incident, importance, and attack methods, it rose to 21% whereas North Korea recorded 68%.

In fact, North Korea has carried out cyber provocations when inter-Korean relations were strained. With Chairman Kim Jong Un recently defining inter-Korean relations as “hostile”, it is expected that the level of provocations will increase in the future.

The NIS also claimed that it showed a pattern of changing attack targets swiftly by the level of Chairman Kim’s remarks. For instance, when Chairman Kim directed the resolution of food shortages, the DPRK concentrated attacks on Korean agricultural and fisheries institutions, and when he emphasized naval power in August and September, they hacked Korean shipbuilders and stole blueprints and design data. In October, there were confirmed cases of collecting drone engine data from Korean and foreign institutions in line with Chairman Kim’s directive to produce drones.

Notably, North Korea has also shown attempts to hack Russian defense companies, despite their friendly relations. With bank security systems strengthened, they have changed their attack targets to focus on cryptocurrency exchanges, and recently they have expanded their theft targets to include personal cryptocurrencies.

The NIS also expressed concerns about China’s illegal cyber influence in the lead-up to the elections. Recently, Chinese PR companies have been found to have set up about 200 sites disguised as Korean media outlets and posted pro-China and anti-US content. The NIS announced its plan to check the operation status of the national satellite communication network.

Baek Jong-wook, the third deputy director of the NIS, said, “As more than half of the world’s population participates in voting this year, we will do our best to block cyber threats with thorough preparation for the hacking of election systems, fake news, and dissemination of false information.” He emphasized, “If a government computer network fails, we will not rule out the possibility of hacking and will actively respond from the beginning of the accident.”

The NIS pointed out, “Considering the recent trends of cyber warfare, such as Russia-Ukraine and Hamas-Israel, where hacker organizations participate in the conflict, we cannot rule out the possibility of international hacker groups with political and religious backgrounds participating in cyber attacks.”