{"id":249621,"date":"2024-05-28T09:08:51","date_gmt":"2024-05-28T09:08:51","guid":{"rendered":"https:\/\/www.techopedia.com\/?p=249621"},"modified":"2024-05-28T09:08:51","modified_gmt":"2024-05-28T09:08:51","slug":"how-north-koreas-cyber-war-chases-espionage-and-crypto-heists","status":"publish","type":"post","link":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists","title":{"rendered":"How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists"},"content":{"rendered":"<p>North Korean nation-state hacker groups, along with Russian, Middle East, and Iran <a href=\"https:\/\/www.techopedia.com\/definition\/2410\/hacktivism\">hacktivists<\/a> are among the most prolific active groups seeding digital chaos day in and day out.<\/p>\n<p>But unlike other nation-state groups, North Korean hackers take a widely different approach.<\/p>\n<p>Under the umbrella of the Democratic People&#8217;s Republic of Korea (DPRK) military intelligence organization, coordinated strategies break in two directions: espionage and crypto heists that are allegedly used to fund sanctioned military programs. These fronts are led by groups like <a href=\"https:\/\/www.techopedia.com\/north-koreas-600-million-crypto-heist-deep-dive-into-2023s-cyberattacks\">Lazarus<\/a> \u2014 who focus on crypto theft at a large scale \u2014 while groups like Kimsuky focus on North Korea\u2019s cyber espionage campaigns.<\/p>\n<p>The targets? South Korea, the U.S., its allies, and any organization or individual that is in possession of valuable intelligence for North Korea or stands in the way of their military and political agenda.<\/p>\n<div class=\"su-note\"  style=\"border-color:#dddddd;border-radius:3px;-moz-border-radius:3px;-webkit-border-radius:3px;\"><div class=\"su-note-inner su-u-clearfix su-u-trim\" style=\"background-color:#f7f7f7;border-color:#ffffff;color:#333333;border-radius:3px;-moz-border-radius:3px;-webkit-border-radius:3px;\">\n<h2><span id=\"key_takeaways\">Key Takeaways<\/span><\/h2>\n<ul>\n<li>North Korea regularly stands accused of using cyberattacks for espionage and financial gain, including claims of funding their WMD programs by stealing secrets and cryptocurrencies through hacking groups like Kimsuky and Lazarus.<\/li>\n<li>While intended to curb these activities, sanctions may be driving North Korea to cybercrime and pushing the country towards more cyberattacks.<\/li>\n<li>The FBI and the NSA recommend that organizations protect themselves with DMARC to prevent spear phishing espionage attacks, which Kimsuky uses.<\/li>\n<li>With sanctions being ineffective and the threat landscape escalating, a new international approach could be the way forward.<\/li>\n<\/ul>\n<\/div><\/div>\n<div>\n    <section class=\"toc-sticky w-100 bg-white \">\n        <div class=\"toc-sticky__container container\">\n            <div class=\"toc-sticky__open d-flex align-items-end\" data-bs-toggle=\"collapse\"\n                 aria-controls=\"multiCollapse1\"\n                 data-bs-target=\"#multiCollapse1\">\n                <button\n                        class=\"btn btn-primary collapse-action-btn p-1 rounded-circle\"\n                        type=\"button\"\n                >\n                    <i class=\"icon-chevron-up\"><\/i>\n                <\/button>\n                <span id=\"toc-current-title\" class=\"d-flex align-items-center\">\n                    Table of Contents\n                <\/span>\n                <span class=\"toc-main-title-permanent\">Table of Contents<\/span>\n            <\/div>\n            <div\n                    class=\"collapse my-3\"\n                    id=\"multiCollapse1\"\n            >\n                <ol class=\"StepProgress\">\n                                                                        <li class=\"StepProgress-item current\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"key_takeaways\"\n                               onclick=handleScrollToTitle(\"key_takeaways\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">Key Takeaways<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"nsa_warns_against_kimsuky\"\n                               onclick=handleScrollToTitle(\"nsa_warns_against_kimsuky\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">NSA Warns Against Kimsuky<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"un_says_lazarus_and_kimsuky_fund_50_of_wmd\"\n                               onclick=handleScrollToTitle(\"un_says_lazarus_and_kimsuky_fund_50_of_wmd\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">U.N Says Lazarus and Kimsuky Fund 50% of WMD<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"lazarus_group_a_phantom_hyrda\"\n                               onclick=handleScrollToTitle(\"lazarus_group_a_phantom_hyrda\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">Lazarus Group: A Phantom Hyrda?<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"when_sanctions_backfire\"\n                               onclick=handleScrollToTitle(\"when_sanctions_backfire\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">When Sanctions Backfire<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"nsa_and_the_fbi_how_organizations_should_protect_themselves_against_north_korean_cyber_espionage\"\n                               onclick=handleScrollToTitle(\"nsa_and_the_fbi_how_organizations_should_protect_themselves_against_north_korean_cyber_espionage\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">NSA and the FBI: How Organizations Should Protect Themselves Against North Korean Cyber Espionage<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"the_bottom_line\"\n                               onclick=handleScrollToTitle(\"the_bottom_line\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">The Bottom Line<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                    <\/ol>\n                <div class=\"toc-sticky__container__disperse\"><\/div>\n                <div class=\"toc-sticky__btn-top justify-content-center\">\n                    <button class=\"btn btn-link d-flex align-items-center\" onclick={btnTop()}><p>Show Full Guide<\/p><img decoding=\"async\"\n                                src=\"\/wp-content\/plugins\/table-of-contents\/assets\/images\/arrow-up-circle.svg\"\n                                alt=\"arrow-up-circle\">\n                    <\/button>\n                <\/div>\n            <\/div>\n        <\/div>\n    <\/section>\n    <div class=\"toc-sticky-list\">\n        <div class=\"toc-sticky__container container\">\n            <div class=\"toc-sticky__open d-flex align-items-end\" data-bs-toggle=\"collapse\" aria-controls=\"multiCollapse2\" data-bs-target=\"#multiCollapse2\">\n                <button class=\"btn btn-primary collapse-action-btn p-1 rounded-circle\"\n                        type=\"button\">\n                    <i class=\"icon-chevron-up up\"><\/i>\n                <\/button>\n                <span id=\"toc-current-title\" class=\"d-flex align-items-center\">\n                    Table of Contents\n                <\/span>\n            <\/div>\n            <div  class=\"collapse my-3\" id=\"multiCollapse2\">\n                <ol class=\"StepProgress\">\n                    \t\t\t\t\t \t\t\t\t\t                                                     <li class=\"StepProgress-item current \">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"key_takeaways\"\n                                   onclick=handleScrollToTitle(\"key_takeaways\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">Key Takeaways<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t                                                     <li class=\"StepProgress-item \">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"nsa_warns_against_kimsuky\"\n                                   onclick=handleScrollToTitle(\"nsa_warns_against_kimsuky\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">NSA Warns Against Kimsuky<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t                                                     <li class=\"StepProgress-item \">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"un_says_lazarus_and_kimsuky_fund_50_of_wmd\"\n                                   onclick=handleScrollToTitle(\"un_says_lazarus_and_kimsuky_fund_50_of_wmd\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">U.N Says Lazarus and Kimsuky Fund 50% of WMD<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t\n\t\t\t\t\t\t <span class=\"show_moretoc\">Show Full Guide<\/span>\n\t\t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"lazarus_group_a_phantom_hyrda\"\n                                   onclick=handleScrollToTitle(\"lazarus_group_a_phantom_hyrda\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">Lazarus Group: A Phantom Hyrda?<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"when_sanctions_backfire\"\n                                   onclick=handleScrollToTitle(\"when_sanctions_backfire\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">When Sanctions Backfire<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"nsa_and_the_fbi_how_organizations_should_protect_themselves_against_north_korean_cyber_espionage\"\n                                   onclick=handleScrollToTitle(\"nsa_and_the_fbi_how_organizations_should_protect_themselves_against_north_korean_cyber_espionage\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">NSA and the FBI: How Organizations Should Protect Themselves Against North Korean Cyber Espionage<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"the_bottom_line\"\n                                   onclick=handleScrollToTitle(\"the_bottom_line\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">The Bottom Line<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                                    <\/ol>\n            <\/div>\n            <div class=\"toc-sticky__container__disperse\"><\/div>\n        <\/div>\n    <\/div>\n<\/div>\n\n<script id=\"toc-js\">\n    window.addEventListener(\"DOMContentLoaded\", () => {\n        const header = document.querySelector(\".header_wrapper\");\n\n        const pageLegend = document.querySelector('#multiCollapse1');\n        const pageLegendList = document.querySelector('#multiCollapse2');\n        const pageLegendCollapse = new bootstrap.Collapse(pageLegend, {toggle: document.querySelector(\".toc-sticky\").classList.contains('sticky')});\n\n        \/**\n         * Changing current title\n         *\/\n        (function (pageLegend) {\n            const titleNodes = pageLegend.querySelectorAll('.StepProgress-item__link');\n\n            if (!titleNodes.length) return;\n\n            const titles = [...titleNodes].map((itm, i) => ({\n                id: itm.getAttribute('data-id'),\n                text: itm.textContent,\n                level: itm.getAttribute('data-level'),\n                linkNode: itm,\n                titleNode: document.getElementById(itm.getAttribute('data-id')),\n                index: i,\n            }));\n\n            \/**\n             * Source: https:\/\/www.sitepoint.com\/throttle-scroll-events\/\n             * @param {Function} fn\n             * @param {number} wait\n             * @returns {(function(): void)|*}\n             *\/\n            const throttle = (fn, wait) => {\n                let time = Date.now();\n                return function () {\n                    if ((time + wait - Date.now()) < 0) {\n                        fn();\n                        time = Date.now();\n                    }\n                }\n            }\n\n            const changeCurrentTitle = () => {\n                const documentScrollTop = window.pageYOffset || document.documentElement.scrollTop || document.body.scrollTop || 0;\n                let current = 0;\n\n                \/\/ Title\n                titles.forEach((itm, i) => {\n\t\t\t\t\/\/console.log(itm)\n                    const itmOffsetTop = itm.titleNode ? itm.titleNode.offsetTop - 100 : 0;\n\n                    if (documentScrollTop >= itmOffsetTop) {\n                        document.getElementById('toc-current-title').innerHTML = itm.text;\n                        document.getElementById('toc-current-title').setAttribute('data-current-id', itm.id);\n                        document.getElementById('toc-current-title').setAttribute('data-current-level', itm.level);\n                        current = i;\n                    }\n                })\n\n                \/\/ close all list and open sub list if needed\n                if (document.querySelector(\".toc-sticky\").classList.contains('sticky')) {\n                    document.querySelectorAll('.subList-in-progress').forEach((el) => {\n                        el.children[1].classList.remove('show');\n                        el.getElementsByClassName('icon-chevron-down')[0].classList.remove('up');\n                    });\n                    const currentEl = titles[current];\n                    currentEl.linkNode.classList.add('show');\n                }\n\n                titles.forEach((itm, i) => {\n                    itm.linkNode.parentNode.parentNode.classList.remove('current', 'is-done');\n                    if (current > i) {\n                        itm.linkNode.parentNode.parentNode.classList.add('is-done')\n                    };\n                    if (current === i) {\n                      itm.linkNode.parentNode.parentNode.classList.add('current');\n                    };\n                })\n\n            }\n\n            changeCurrentTitle();\n\n            document.addEventListener('scroll', throttle(changeCurrentTitle, 50));\n        })(pageLegend);\n\n\n        \/**\n         *  Collapse\n         *\/\n        (function (pageLegend, header) {\n            const icon = pageLegend.parentNode.querySelector(\".collapse-action-btn i\");\n\n            const collapseToggle = (status) => (e) => {\n                if (!e.target.isEqualNode(pageLegend)) return;\n\n                icon.classList.toggle(\"up\");\n\n                const containerHeight = pageLegend.getBoundingClientRect().height;\n\n                const showSubtitleContent = () => {\n                    const currentId = document.getElementById('toc-current-title').getAttribute('data-current-id');\n                    const currentLevel = document.getElementById('toc-current-title').getAttribute('data-current-level');\n                    const currentSubTitle = currentLevel == 3 ? document.querySelector(`a[data-id=\"${currentId}\"]`).parentNode.parentNode.parentNode : false;\n\n                    if (!currentSubTitle) return;\n                    new bootstrap.Collapse(currentSubTitle, {toggle: false}).show();\n                }\n\n                showSubtitleContent();\n                if (status === 'shown' && document.querySelector(\".toc-sticky\").classList.contains('sticky') ) {\n                    document.querySelector('html').classList.remove('overflow-hidden');\n                    pageLegend.classList.add('overflow-auto');\n                    pageLegend.style.height = `calc(100vh - ${header.getBoundingClientRect().height + document.querySelector('.toc-sticky__open').getBoundingClientRect().height + 16}px)`;\n                } else if (status === 'hide') {\n                    document.querySelector('html').classList.remove('overflow-hidden');\n                    pageLegend.classList.remove('overflow-auto');\n                    pageLegend.style.height = 'auto';\n                }\n            }\n\n            pageLegend.addEventListener('shown.bs.collapse', collapseToggle('shown'));\n            pageLegend.addEventListener('hide.bs.collapse', collapseToggle('hide'));\n        })(pageLegend, header);\n\n        \/**\n         * Collapse sub-titles\n         *\/\n        (function (pageLegend) {\n            const collapseEls = pageLegend.querySelectorAll('.collapse');\n\n            collapseEls.forEach(function (el) {\n\n                const toggleArrowDirection = function (e) {\n                    if (!e.target.isEqualNode(el)) return;\n\n                    const id = this.getAttribute('id');\n                    document.querySelector(`.collapse-action-btn[data-bs-target=\"#${id}\"] .icon-chevron-down`).classList.toggle('up');\n                }\n                el.addEventListener('shown.bs.collapse', toggleArrowDirection);\n                el.addEventListener('hide.bs.collapse', toggleArrowDirection);\n            })\n        })(pageLegend);\n\n        \/**\n         *  Collapse main title\n         *\/\n        (function (pageLegendList) {\n            const icon = pageLegendList.parentNode.querySelector(\".collapse-action-btn i\");\n\n            const collapseToggle = () => (e) => {\n                if (!e.target.isEqualNode(pageLegendList)) return;\n\n                icon.classList.toggle(\"up\");\n\n            }\n            pageLegendList.addEventListener('shown.bs.collapse', collapseToggle());\n            pageLegendList.addEventListener('hide.bs.collapse', collapseToggle());\n        })(pageLegendList);\n\n        (function (pageLegendList) {\n            const collapseEls = pageLegendList.querySelectorAll('.collapse');\n\n            collapseEls.forEach(function (el) {\n\n                const toggleArrowDirection = function (e) {\n                    if (!e.target.isEqualNode(el)) return;\n\n                    const id = this.getAttribute('id');\n                    document.querySelector(`.toc-sticky-list .collapse-action-btn[data-bs-target=\"#${id}\"] .icon-chevron-down`).classList.toggle('up');\n                }\n                el.addEventListener('shown.bs.collapse', toggleArrowDirection);\n                el.addEventListener('hide.bs.collapse', toggleArrowDirection);\n            })\n        })(pageLegendList);\n\n        \/**\n         * Sticky functionality\n         * Source: https:\/\/stackoverflow.com\/questions\/17893771\/javascript-sticky-div-after-scroll\n         *\/\n        (function (header, pageLegendCollapse) {\n            \/\/ set everything outside the onscroll event (less work per scroll)\n            const target = document.querySelector(\".toc-sticky\");\n            const targetListStatic = document.querySelector(\".toc-sticky-list\");\n\n            if (!target || !header) return;\n\n            const headerHeight = header.getBoundingClientRect().height;\n            const targetHeight = targetListStatic.getBoundingClientRect().height;\n\n            \/\/ -headerHeight so it won't be jumpy\n            const stop = targetListStatic.offsetTop + headerHeight + targetHeight;\n            const docBody =\n                document.documentElement || document.body.parentNode || document.body;\n            const hasOffset = window.pageYOffset !== undefined;\n\n            const applySticky = function () {\n                \/\/ cross-browser compatible scrollTop.\n                const scrollTop = hasOffset ? window.pageYOffset : docBody.scrollTop;\n\n                \/\/ if user scrolls to headerHeight from the top of the target div\n                if (scrollTop >= stop) {\n                    pageLegendCollapse.hide();\n                    \/\/ stick the div\n                    target.classList.add(\"sticky\");\n                    \/\/target.style.marginTop = `${headerHeight}px`;\n                } else {\n                    pageLegendCollapse.show();\n                    \/\/ release the div\n                    target.classList.remove(\"sticky\");\n                    target.style.marginTop = \"\";\n                }\n            }\n\n            applySticky();\n\n            window.addEventListener('scroll', applySticky);\n        })(header, pageLegendCollapse);\n\tjQuery('span.show_moretoc').click(function(){\n\t\tjQuery('span.show_moretoc').hide();\n\t   jQuery('.ms_hidetoc').show();\n\t});\n    });\n\n    \/\/ When the user clicks on the button, scroll to the top of the document\n    function btnTop() {\n        const pageLegend = document.querySelector('#multiCollapse1');\n        document.querySelector('html').classList.remove('overflow-hidden');\n        pageLegend.classList.remove('overflow-auto');\n        pageLegend.style.height = 'auto';\n        window.scrollTo({\n            top: 0,\n            behavior: 'smooth'\n        });\n    }\n\n    const handleScrollToTitle = (id) => {\n        const el = document.getElementById(id);\n        const headerHeightDifference = window.innerWidth < 992 ? -30 : -15;\n        window.scrollTo({\n            top: el.offsetTop - 60 - headerHeightDifference - 10,\n        });\n    }\n<\/script>\n\n<h2><span id=\"nsa_warns_against_kimsuky\">NSA Warns Against Kimsuky<\/span><\/h2>\n<p>On May 2, the Federal Bureau of Investigation (FBI), the U.S. Department of State, and the National Security Agency (NSA) <a href=\"https:\/\/www.ic3.gov\/Media\/News\/2024\/240502.pdf\" target=\"_blank\">issued a joint advisory<\/a> warning that the DPRK-linked Kimsuky group was exploiting a new technique to drive a large-scale illegal espionage campaign.<\/p>\n<p>Running spearphishing campaigns, Kimsuky hackers pose as legitimate journalists, academics, or other experts in East Asian affairs with credible links to North Korea policy circles. The group is going after intelligence on geopolitical events, adversary foreign policy strategies, and any information affecting North Korean interests by gaining illicit access to targets\u2019 private documents, research, and communications.<\/p>\n<p>The U.S. Government warned that the operation is sustained and persistent and linked the actions to North Korea\u2019s premier military intelligence organization, the Reconnaissance General Bureau (RGB), which has been sanctioned by the United Nations Security Council.<\/p>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/crystal-morin-416494228\/\" target=\"_blank\"><strong>Crystal Morin<\/strong><\/a><strong>, Former linguist and intelligence analyst in the United States Air Force and today Cybersecurity Strategist at <\/strong><a href=\"https:\/\/sysdig.com\/\" target=\"_blank\"><strong>Sysdig<\/strong><\/a> \u2014 a company that secures cloud and containerized environments \u2014 spoke to Techopedia about the origin of Kimsuky.<\/p>\n<blockquote><p>\u201cThe Kimsuky threat actor group has been traced back to 2012. I would correlate the rise of this APT with Kim Jung Un\u2019s successor to Supreme Leader of North Korea and appointment of Supreme Commander of the Korean People\u2019s Army.\u201d<\/p><\/blockquote>\n<p>\u201cI don\u2019t think this can or has been confirmed, but the timelines line up, indicating that Kimsuky was an idea of Kim Jung Un and his party,\u201d Morin said.<\/p>\n<blockquote><p>\u201cTheir priority is intel gathering. They have a strategic objective, likely similar to NSA, to inform government and military officials and tactical objectives.\u201d<\/p><\/blockquote>\n<h2><span id=\"un_says_lazarus_and_kimsuky_fund_50_of_wmd\">U.N Says Lazarus and Kimsuky Fund 50% of WMD<\/span><\/h2>\n<p>While Kimsuky focuses on the intelligence side of North Korean global cyber warfare operations, Lazarus group continues to reap illegal financial gains through cyberattacks mostly directed towards the crypto industry.<\/p>\n<p>In March 2024, investigators of the <a href=\"https:\/\/documents.un.org\/doc\/undoc\/gen\/n24\/032\/68\/pdf\/n2403268.pdf?token=taQfRbwLm8O26oqPId&amp;fe=true\" target=\"_blank\">United Nations announced they were looking into 58 suspected crypto cyberattacks<\/a> by the DPRK. U.N. said the attacks combined total $3 billion. The illegal funds were linked to funding North Korea\u2019s conventional arms, munitions, nuclear weapons, intercontinental ballistic missiles, and weapons of mass destruction \u2014 all in contravention of international sanctions.<\/p>\n<p>According to the U.N. Member States report 40 to 50% of the weapons of mass destruction programmes of North Korea are funded by illicit cyber means.<\/p>\n<p>North Korea is also funding AI, machine learning, and new disruptive technology development programs under this illegal and internationally sanctioned scheme.<\/p>\n<h2><span id=\"lazarus_group_a_phantom_hyrda\">Lazarus Group: A Phantom Hyrda?<\/span><\/h2>\n<p>The U.N. investigation found that Kimsuky and Lazarus groups share infrastructure and seem to operate in coordination. However, experts believe there could be more than one group hiding behind the Lazarus group.<\/p>\n<p>\u201cKimsuky is a North Korean <a href=\"https:\/\/www.techopedia.com\/definition\/28118\/advanced-persistent-threat-apt\">advanced persistent threat<\/a> (APT). However, North Korean cyberattacks and threat actors are notoriously difficult to attribute. You\u2019ll often see campaigns bucketed under Lazarus Group instead of being broken out into the more specific APT designations,\u201d Morin from Sysdig told Techopedia.<\/p>\n<h2><span id=\"when_sanctions_backfire\">When Sanctions Backfire<\/span><\/h2>\n<p>Virtually cut off and isolated from most of the world, North Korea has lived under hard-line sanctions for long decades. Sanctions against the country started in the 1950s,\u00a0 strengthened in the 1980s, and again in 2006 shortly after North Korea&#8217;s first nuclear test on October 9, 2006. The country faced additional sanctions in 2013.<\/p>\n<p>From oil to cash flow, defense and weapons, technology, minerals, and more, sanctions have led to a decline in North Korea&#8217;s trade volume, stagnation of its industries and markets, and impacted energy and food production systems.<\/p>\n<p>The most vulnerable population groups are the most affected in North Korea, with malnutrition affecting <a href=\"https:\/\/www.ncbi.nlm.nih.gov\/pmc\/articles\/PMC5769832\" target=\"_blank\">children the most<\/a> and scholars asking the question of <a href=\"https:\/\/onlinelibrary.wiley.com\/doi\/10.1111\/pafo.12242\" target=\"_blank\">how sanctions impact the humanitarian and food crisis<\/a> in the country.<\/p>\n<p>Despite being the most sanctioned country in the world, many have questioned whether the approach actually works. Benjamin Katzeff Silberstein of The Swedish Institute of International Affairs, writing for <a href=\"https:\/\/eastasiaforum.org\/2023\/07\/05\/the-complicated-truth-about-sanctions-on-north-korea\/\" target=\"_blank\">East Asia Forum<\/a> said that North Korea regularly circumvents sanctions through \u201ccomplex smuggling operations\u201d.<\/p>\n<p>Like many others, Silberstein believes that on the surface, sanctions seem to have had little impact on North Korea\u2019s behavior.<\/p>\n<p>Stripped of cash, and unwilling to comply with sanctions, especially those who forbid the country to build up its military capabilities, North Korea has allegedly taken to the <a href=\"https:\/\/www.techopedia.com\/definition\/13600\/cyberwarfare\">cyberwarfare<\/a> arena in search of resources and intelligence.<\/p>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/nazar-tymoshyk\/\" target=\"_blank\"><strong>Nazar Tymloshyk<\/strong><\/a><strong>, CEO at <\/strong><a href=\"https:\/\/underdefense.com\/\" target=\"_blank\"><strong>UnderDefense<\/strong><\/a> \u2014 a security provider \u2014 explained why cyberspace is ideal for North Korea.<\/p>\n<blockquote><p>\u201cIt is difficult to say definitively that international sanctions have any effect on North Korea hacking groups. Sanctions don&#8217;t work in cyberspace.\u201d<\/p><\/blockquote>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/malachijwalker\/\" target=\"_blank\">Malachi Walker<\/a>, Security Advisor for <a href=\"https:\/\/www.domaintools.com\/\" target=\"_blank\">DomainTools<\/a> also spoke to Techopedia about the issue.<\/p>\n<blockquote><p>\u201cIn the case of North Korea sanctions have been largely unenforced from 2018 until a new sanctions package released by the United States Department of Treasury has been released in early 2022.\u201d<\/p><\/blockquote>\n<p>\u201cStill, in that same year, North Korean hackers stole $1.7 billion of cryptocurrency according to blockchain analysis firm <a href=\"https:\/\/www.chainalysis.com\/blog\/2022-biggest-year-ever-for-crypto-hacking\/\" target=\"_blank\">Chainanalysis<\/a>,\u201d Walker said.<\/p>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/jstephenkowski\/\" target=\"_blank\"><strong>Stephen Kowski<\/strong><\/a><strong>, Field CTO, <\/strong><a href=\"https:\/\/slashnext.com\/\" target=\"_blank\"><strong>SlashNext<\/strong><\/a>, told Techopedia that sanctions on North Korea are backfiring and unwillingly driving the country\u2019s push into illegal cyber operations.<\/p>\n<blockquote><p>\u201cInternational sanctions against North Korea have inadvertently pushed the regime to rely more on its cyber capabilities, including groups like Kimsuky, for financial gain and intelligence gathering.\u201d<\/p>\n<p>&nbsp;<\/p>\n<p>\u201cThese sanctions have made cyber operations cost-effective and low-risk for the DPRK to fund its activities and circumvent restrictions.\u201d<\/p><\/blockquote>\n<h2><span id=\"nsa_and_the_fbi_how_organizations_should_protect_themselves_against_north_korean_cyber_espionage\">NSA and the FBI: How Organizations Should Protect Themselves Against North Korean Cyber Espionage<\/span><\/h2>\n<p>In the latest joint advisory, the FBI and the NSA warned that Kimsuky is using a new technique that involves exploiting weak DMARC security policies to mask spearphishing campaigns.<\/p>\n<p>DMARC \u2014 short for <a href=\"https:\/\/www.techopedia.com\/definition\/6885\/domain-based-message-authentication-reporting-and-conformance-dmarc\">Domain-based Message Authentication, Reporting &amp; Conformance<\/a> \u2014 is an email security protocol that works with other methods to prevent email spoofing. It lets domain owners define how to handle emails that fail authentication checks, protecting their reputation and reducing phishing attacks.<\/p>\n<p>While DMARC policies can play a vital role in identifying and stopping email <a href=\"https:\/\/www.techopedia.com\/definition\/4049\/phishing\">phishing<\/a> attacks, due to lack of awareness, technical complexities, and fear of disruption, it is common for businesses, individuals, and organizations either not to enable DMARC controls or to misconfigure them.<\/p>\n<p>Morin from Sysdig told Techopedia the North Korean cyberespionage group Kimsuky targets missing or misconfigured DMARC policies.<\/p>\n<blockquote><p>\u201cThis new technique will almost certainly improve Kimsuky&#8217;s success rate for spear phishing campaigns as the technique is clever from an attacker&#8217;s perspective.\u201d<\/p><\/blockquote>\n<h3>Target, breach, and exfiltration<\/h3>\n<p>Morin explained that data exfiltration from the targeting of misconfigured or poor DMARC policies is likely no different from Kimsuky\u2019s standard exfil technique for <a href=\"https:\/\/www.techopedia.com\/definition\/4121\/spear-phishing\">spear phishing<\/a> attacks: send the phish, hook the victim, obtain initial access, find interesting data, and exfil interesting data.<\/p>\n<blockquote><p>\u201cAccording to CISA and MITRE reporting, Kimsuky uses its malware on the victim machine to encrypt the data and send it to a C2 server through email.\u201d<\/p><\/blockquote>\n<p>DMARC policies \u2014 which are rather simple to implement, especially compared to the risk of not enabling them \u2014\u00a0 when correctly enabled and configured, are a means of email security and authentication to help filter out spam and domain spoofing (ie. phishing attempts). DMARC verifies the sender&#8217;s legitimacy and email authenticity.<\/p>\n<p>Security teams looking for mitigation technical details and guidelines, as well as lists of red flags to watch out for, can check out the <a href=\"https:\/\/www.ic3.gov\/Media\/News\/2024\/240502.pdf\" target=\"_blank\">FBI-NSA document<\/a>.<\/p>\n<h2><span id=\"the_bottom_line\">The Bottom Line<\/span><\/h2>\n<p>North Korea&#8217;s cyberattacks are a two-front assault, stealing intelligence and cryptocurrencies to fuel their sanctioned programs. Sanctions, while intended to stop these activities, seem to be backfiring and affecting the most vulnerable.<\/p>\n<p>The international community must explore alternative methods to curb North Korea&#8217;s cyberwarfare. This could involve increased diplomatic efforts, collaboration on cyber defenses, information sharing among governments and businesses, and stricter enforcement of existing sanctions to close loopholes.<\/p>\n<p>While simple technical solutions exist, for example, to enable DMARC to thwart Kimsuky&#8217;s phishing attacks, a wider solution remains tied to the geopolitical state of global affairs.<\/p>\n<p>As demonizing entire nations becomes the common way forward, it also polarizes society and fuels the &#8220;us vs. them&#8221; mentality that hinders productive dialogue and international cooperation. A new approach that focuses on addressing root causes that push North Korea towards cybercrime could provide a more sustainable path forward.\u0442<\/p>\n","protected":false},"excerpt":{"rendered":"<p>North Korean nation-state hacker groups, along with Russian, Middle East, and Iran hacktivists are among the most prolific active groups seeding digital chaos day in and day out. But unlike other nation-state groups, North Korean hackers take a widely different approach. Under the umbrella of the Democratic People&#8217;s Republic of Korea (DPRK) military intelligence organization, [&hellip;]<\/p>\n","protected":false},"author":286688,"featured_media":249626,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_lmt_disableupdate":"no","_lmt_disable":"","om_disable_all_campaigns":false,"footnotes":""},"categories":[585,548],"tags":[],"category_partsoff":[],"class_list":["post-249621","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-threats","category-cybersecurity"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v24.2 (Yoast SEO v24.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists Techopedia<\/title>\n<meta name=\"description\" content=\"Experts discuss claims that North Korea&#039;s sophisticated cyber attacks target international intelligence secrets and use cryptocurrencies to fund sanctioned programs.\" \/>\n<meta name=\"robots\" content=\"noindex, follow\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists\" \/>\n<meta property=\"og:description\" content=\"Experts discuss claims that North Korea&#039;s sophisticated cyber attacks target international intelligence secrets and use cryptocurrencies to fund sanctioned programs.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists\" \/>\n<meta property=\"og:site_name\" content=\"Techopedia\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/techopedia\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-05-28T09:08:51+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/05\/How-North-Koreas-Cyber-War-Chases-Espionage-and-Crypto-Heists.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"686\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Ray Fernandez\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@techopedia\" \/>\n<meta name=\"twitter:site\" content=\"@techopedia\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ray Fernandez\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists\"},\"author\":{\"name\":\"Ray Fernandez\",\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/person\/687890072e5e44867899acd7d6176e6c\"},\"headline\":\"How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists\",\"datePublished\":\"2024-05-28T09:08:51+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists\"},\"wordCount\":1627,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.techopedia.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/05\/How-North-Koreas-Cyber-War-Chases-Espionage-and-Crypto-Heists.webp\",\"articleSection\":\"\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#respond\"]}],\"copyrightYear\":\"2024\",\"copyrightHolder\":{\"@id\":\"https:\/\/www.techopedia.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists\",\"url\":\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists\",\"name\":\"How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists Techopedia\",\"isPartOf\":{\"@id\":\"https:\/\/www.techopedia.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/05\/How-North-Koreas-Cyber-War-Chases-Espionage-and-Crypto-Heists.webp\",\"datePublished\":\"2024-05-28T09:08:51+00:00\",\"description\":\"Experts discuss claims that North Korea's sophisticated cyber attacks target international intelligence secrets and use cryptocurrencies to fund sanctioned programs.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#primaryimage\",\"url\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/05\/How-North-Koreas-Cyber-War-Chases-Espionage-and-Crypto-Heists.webp\",\"contentUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/05\/How-North-Koreas-Cyber-War-Chases-Espionage-and-Crypto-Heists.webp\",\"width\":1200,\"height\":686,\"caption\":\"How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.techopedia.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity\",\"item\":\"https:\/\/www.techopedia.com\/topic\/4\/cybersecurity\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Cyber Threats\",\"item\":\"https:\/\/www.techopedia.com\/topic\/220\/cyber-threats\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.techopedia.com\/#website\",\"url\":\"https:\/\/www.techopedia.com\/\",\"name\":\"Techopedia\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.techopedia.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.techopedia.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.techopedia.com\/#organization\",\"name\":\"Techopedia\",\"url\":\"https:\/\/www.techopedia.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2025\/02\/techopedia-light-logo.svg\",\"contentUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2025\/02\/techopedia-light-logo.svg\",\"caption\":\"Techopedia\"},\"image\":{\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/techopedia\/\",\"https:\/\/x.com\/techopedia\",\"https:\/\/www.linkedin.com\/company\/techopedia\/\",\"https:\/\/www.youtube.com\/c\/Techopedia\"],\"publishingPrinciples\":\"https:\/\/www.techopedia.com\/about\/editorial-policy\",\"ownershipFundingInfo\":\"https:\/\/www.techopedia.com\/about\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/person\/687890072e5e44867899acd7d6176e6c\",\"name\":\"Ray Fernandez\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2023\/10\/avatar_user_286688_1698354675-300x300.jpg\",\"contentUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2023\/10\/avatar_user_286688_1698354675-300x300.jpg\",\"caption\":\"Ray Fernandez\"},\"description\":\"Ray is an independent journalist with 15 years of experience, focusing on the intersection of technology with various aspects of life and society. He joined Techopedia in 2023 after publishing in numerous media, including Microsoft, TechRepublic, Moonlock, Hackermoon, VentureBeat, Entrepreneur, and ServerWatch. He holds a degree in Journalism from Oxford Distance Learning and two specializations from FUNIBER in Environmental Science and Oceanography. When Ray is not working, you can find him making music, playing sports, and traveling with his wife and three kids.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/ray-fernandez\/\"],\"knowsAbout\":[\"Senior Technology Journalist\"],\"url\":\"https:\/\/www.techopedia.com\/contributors\/rayfernandez\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists Techopedia","description":"Experts discuss claims that North Korea's sophisticated cyber attacks target international intelligence secrets and use cryptocurrencies to fund sanctioned programs.","robots":{"index":"noindex","follow":"follow"},"og_locale":"en_US","og_type":"article","og_title":"How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists","og_description":"Experts discuss claims that North Korea's sophisticated cyber attacks target international intelligence secrets and use cryptocurrencies to fund sanctioned programs.","og_url":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists","og_site_name":"Techopedia","article_publisher":"https:\/\/www.facebook.com\/techopedia\/","article_published_time":"2024-05-28T09:08:51+00:00","og_image":[{"width":1200,"height":686,"url":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/05\/How-North-Koreas-Cyber-War-Chases-Espionage-and-Crypto-Heists.webp","type":"image\/webp"}],"author":"Ray Fernandez","twitter_card":"summary_large_image","twitter_creator":"@techopedia","twitter_site":"@techopedia","twitter_misc":{"Written by":"Ray Fernandez","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#article","isPartOf":{"@id":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists"},"author":{"name":"Ray Fernandez","@id":"https:\/\/www.techopedia.com\/#\/schema\/person\/687890072e5e44867899acd7d6176e6c"},"headline":"How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists","datePublished":"2024-05-28T09:08:51+00:00","mainEntityOfPage":{"@id":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists"},"wordCount":1627,"commentCount":0,"publisher":{"@id":"https:\/\/www.techopedia.com\/#organization"},"image":{"@id":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#primaryimage"},"thumbnailUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/05\/How-North-Koreas-Cyber-War-Chases-Espionage-and-Crypto-Heists.webp","articleSection":"","inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#respond"]}],"copyrightYear":"2024","copyrightHolder":{"@id":"https:\/\/www.techopedia.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists","url":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists","name":"How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists Techopedia","isPartOf":{"@id":"https:\/\/www.techopedia.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#primaryimage"},"image":{"@id":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#primaryimage"},"thumbnailUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/05\/How-North-Koreas-Cyber-War-Chases-Espionage-and-Crypto-Heists.webp","datePublished":"2024-05-28T09:08:51+00:00","description":"Experts discuss claims that North Korea's sophisticated cyber attacks target international intelligence secrets and use cryptocurrencies to fund sanctioned programs.","breadcrumb":{"@id":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#primaryimage","url":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/05\/How-North-Koreas-Cyber-War-Chases-Espionage-and-Crypto-Heists.webp","contentUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/05\/How-North-Koreas-Cyber-War-Chases-Espionage-and-Crypto-Heists.webp","width":1200,"height":686,"caption":"How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists"},{"@type":"BreadcrumbList","@id":"https:\/\/www.techopedia.com\/how-north-koreas-cyber-war-chases-espionage-and-crypto-heists#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.techopedia.com\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity","item":"https:\/\/www.techopedia.com\/topic\/4\/cybersecurity"},{"@type":"ListItem","position":3,"name":"Cyber Threats","item":"https:\/\/www.techopedia.com\/topic\/220\/cyber-threats"},{"@type":"ListItem","position":4,"name":"How North Korea\u2019s Cyber War Chases Espionage and Crypto Heists"}]},{"@type":"WebSite","@id":"https:\/\/www.techopedia.com\/#website","url":"https:\/\/www.techopedia.com\/","name":"Techopedia","description":"","publisher":{"@id":"https:\/\/www.techopedia.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.techopedia.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.techopedia.com\/#organization","name":"Techopedia","url":"https:\/\/www.techopedia.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.techopedia.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2025\/02\/techopedia-light-logo.svg","contentUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2025\/02\/techopedia-light-logo.svg","caption":"Techopedia"},"image":{"@id":"https:\/\/www.techopedia.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/techopedia\/","https:\/\/x.com\/techopedia","https:\/\/www.linkedin.com\/company\/techopedia\/","https:\/\/www.youtube.com\/c\/Techopedia"],"publishingPrinciples":"https:\/\/www.techopedia.com\/about\/editorial-policy","ownershipFundingInfo":"https:\/\/www.techopedia.com\/about"},{"@type":"Person","@id":"https:\/\/www.techopedia.com\/#\/schema\/person\/687890072e5e44867899acd7d6176e6c","name":"Ray Fernandez","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.techopedia.com\/#\/schema\/person\/image\/","url":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2023\/10\/avatar_user_286688_1698354675-300x300.jpg","contentUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2023\/10\/avatar_user_286688_1698354675-300x300.jpg","caption":"Ray Fernandez"},"description":"Ray is an independent journalist with 15 years of experience, focusing on the intersection of technology with various aspects of life and society. He joined Techopedia in 2023 after publishing in numerous media, including Microsoft, TechRepublic, Moonlock, Hackermoon, VentureBeat, Entrepreneur, and ServerWatch. He holds a degree in Journalism from Oxford Distance Learning and two specializations from FUNIBER in Environmental Science and Oceanography. When Ray is not working, you can find him making music, playing sports, and traveling with his wife and three kids.","sameAs":["https:\/\/www.linkedin.com\/in\/ray-fernandez\/"],"knowsAbout":["Senior Technology Journalist"],"url":"https:\/\/www.techopedia.com\/contributors\/rayfernandez"}]}},"modified_by":"arina livanenkova","_links":{"self":[{"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/posts\/249621","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/users\/286688"}],"replies":[{"embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/comments?post=249621"}],"version-history":[{"count":0,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/posts\/249621\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/media\/249626"}],"wp:attachment":[{"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/media?parent=249621"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/categories?post=249621"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/tags?post=249621"},{"taxonomy":"category_partsoff","embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/category_partsoff?post=249621"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}