Heritage Senior Research Fellow Bruce Klingner writes that North Korean missiles and nuclear weapons have garnered fear, international condemnation, and tough sanctions. Pyongyang’s cyber activities, however, have elicited less reaction and punishment despite having been used repeatedly in attacks against governments, financial institutions, and industries.
The attitude of experts toward North Korea’s cyber capabilities was initially dismissive, just as their reaction to the regime’s nuclear and missile programs had been. Many, pointing to the famous nighttime satellite imagery of northeast Asia with a dark North Korea surrounded by the blazing lights of its neighbors, did not believe that the technologically backward regime was capable of sophisticated cyberattacks.
Nevertheless, although the regime fails to provide technological comforts for its populace, Pyongyang developed an advanced cyber warfare prowess that is surpassed by few nations. From initial rudimentary distributed denial-of-service (DDoS) attacks against South Korea, the regime improved its cyber programs to create a robust and global array of disruptive military, financial, and espionage capabilities. As its cyber proficiencies evolved, Pyongyang implemented ever more sophisticated techniques and prioritized financial targets to evade international sanctions and augment the regime’s coffers for its nuclear and missile programs. Although it appears to have de-emphasized cyber operations against military and infrastructure targets in recent years, the regime previously alluded to attacking allied info-centric warfare strategies and civilian networks during a crisis.
The scope of North Korea’s demonstrated cyber capabilities and the severity of other recent cyberattacks, such as the Russian-sponsored SolarWinds hack, Chinese exploitation of Microsoft Exchange vulnerabilities, and DarkSide malware shutting down of the Colonial Pipeline, demonstrate the continued critical vulnerability of the government, financial, infrastructure, and corporate sectors. The United States, in conjunction with foreign governments and the private sector, needs to augment cyber defenses and respond more forcefully to attacks. Failure to do so enables North Korea to continue undermining the effectiveness of international sanctions and leaves the United States and its partners exposed to a potentially devastating cyberattack in the future.
North Korea is a direct threat to the security of the United States, its allies, and the international financial system. Pyongyang continues to augment and refine its nuclear, missile, and cyber threats to the United States and its allies. While its kinetic military attacks have been limited in recent years, the regime has freely engaged in an expansive cyber gray-zone war with much lower risk of retaliation than conventional military actions entail. Pyongyang has conducted cyber guerrilla warfare to steal classified military secrets, has absconded with billions of dollars in money and cybercurrency, has held computer systems hostage, and has inflicted extensive damage on computer networks.
Defending against North Korean cyberattacks requires constant vigilance and rapidly evolving methods and techniques of the sort that law enforcement agencies had to use in response to Pyongyang’s improved tactics for evading sanctions. Complacency or a lack of vigor will leave critical government, military, financial, and industry sectors vulnerable to potentially devastating attacks.
Yet the United States has taken only limited actions against North Korean hackers and foreign countries that allow them to operate and launder money from cybercrimes. Without a firm response from the U.S. to North Korea’s hack of Sony and subsequent threat of terrorism, such attacks against the U.S. and its interests will only grow more common.
Related: Click here to read Heritage Senior Research Fellow Bruce Klingner's commentary on North Korea ramping up nuclear weapons production.
