OPTIV THREAT ACTOR INTEL SERIES #2 NORTH KOREA’S CRIMINAL HACKERS Courtney Falk, Aamil Karimi OPTIV THREAT ACTOR INTEL SERIES #2 | NORTH KOREA’S CRIMINAL HACKERS 1 The Optiv Threat Actor Intel report is a who’s who primer of threat actors across the globe intended to educate readers. The report provides a synopsis of the threat actor, their history and their motivators for easier understanding. Information in the report is a combination of intelligence gathered from public, third- party sources and Optiv’s Global Threat Intelligence Center (gTIC). INTENT OPTIV THREAT ACTOR INTEL SERIES #2 | NORTH KOREA’S CRIMINAL HACKERS 2 INTRODUCTION The Democratic People’s Republic of Korea (DPRK) is unique among nation-states in the way that it combines sanctioned cyber capabilities with cyber-crime. This report looks at the ways that North Korea uses its nation-state assets to commit common crimes. The key question: will the criminal activities of a nation such as North Korea have follow-on repercussions in the event of either a political collapse or reformation? Many modern nation-states have built a cyber-focused military force. Every such cyber force has a defensive component; it implements network and endpoint security measures in order to protect the nation’s resources. Some cyber forces are built to include an offensive component that is able to reach out across the wire and interfere with the functioning of another nation. As with cyber forces, most nations now have their own cyber-criminals, who are technologically skilled yet unemployed/underemployed citizens who want to make more money using their computers to take from others. How the nation-state addresses the cyber-criminal element is a useful way to categorize them. On one extreme are liberal Western nations such as the United States where cyber-crime is just crime by another name. These cyber-criminals are not welcome to participate in most aspects of the nation’s functioning. Moving towards the other end of the spectrum are nations like Russia, China, and Iran. These nations have indigenous cyber-criminal undergrounds, but the government harnesses the skills and resources of the cyber-criminals to prosecute the nation’s policy. By hook or by crook, these criminals follow instructions and tasks given to them by government minders. Sometimes the instructions include the requirement to only target victims outside of the nation they themselves are in. At the farthest end of the government-crime spectrum is North Korea. North Korea has both offensive and defensive cyber capabilities. What makes North Korea unique is not that they harness cyber-criminals, but rather they train their own forces to be criminals. OPTIV THREAT ACTOR INTEL SERIES #2 | NORTH KOREA’S CRIMINAL HACKERS 3 A SOCIO-POLITICAL ANALYSIS OF NORTH KOREA POLITICAL North Korea is a single-party hereditary dictatorship. The nation was founded upon communist ideals by Kim Il-Sung. His son, Kim Jong-Il, took control after his death. The 2011 death of Kim Jong-Il resulted in the transfer of power to his third son, Kim Jong-Un. He is both the Supreme Leader and the Chairman of the Workers’ Party of Korea (WPK). North Korean line of succession (l-r): Kim Il-Sung, Kim Jong-Il, Kim Jong-Un MILITARY The Korean People’s Army (KPA) is one of largest and most powerful organizations in the North Korean government. The KPA claims to be able to mobilize over 5 million personnel, which would account for one quarter of the North Korean population. Stated spending on the military was 15% of GDP, but analysts speculate that it may be twice that. As a reference point, the United States spends 3.5% of GDP on its military. The spending does not necessarily produce results. The North Korean air force has more aircraft than the combined air forces of South Korea and the United States on the Korean Peninsula. However, these 1980s-vintage aircraft are outdated and flown by pilots with less flight hours than their southern counterparts (Hackett & Fitzpatrick, 2018). North Korea has existed in a perpetual state of war since its 1950 attempt to invade its southern neighbor. While an armistice was signed in 1953, there still is no signed peace treaty. The border at the 38th parallel, known as the demilitarized zone (DMZ), is one of the most highly militarized in the world. OPTIV THREAT ACTOR INTEL SERIES #2 | NORTH KOREA’S CRIMINAL HACKERS 4 ECONOMIC North Korea practices a philosophy known as “Juche,” or radical self-reliance. One of the products of this philosophy is Vinylon, a fabric made from limestone (Park & Pearson, 2018). This was a pragmatic response to a lack of raw fibrous material such as cotton. Not to be satisfied with a technological achievement alone, North Korea produced an animated Vinylon Man propaganda series to trumpet their ideological victory. But in reality, sizeable portions of the North Korean population are starving at any given time with the famine that began in 1994 known as The March of Suffering. The military is given priority when it comes to the distribution of food, but estimates of famine-related fatalities vary from one quarter million to more than three million citizens. Source Metric North Korea South Korea Top Rated Country Population 25,248,140 51,181,299 n/a GDP (PPP) $1,400 $39,400 n/a Corruption Transparency New Perceptions Index 174th of 183 54th of 183 International Zealand 2017 ICT Development ITU Not included 2nd of 176 Iceland Index 2017 Global World Economic Competitive Not included 26th of 137 Switzerland Forum Index (2017–2018) Portland Soft Power 30 Not included 20th of 30 United Kingdom Reporters With- 2018 World Press out 180th of 180 Norway Freedom Index 43rd of 180 Borders SOCIAL The family is the core social unit in North Korea. Families are rewarded or punished as a unit. Politically-linked families are allowed to live in the capital, Pyongyang, and receive goods and services not available to the bulk of the country. If a person is arrested and imprisoned for political crimes, their entire family may be imprisoned along with them. Up to three generations of a family might be sent to a camp for political prisoners. There, they are essentially slave labor for the government. BACKGROUND AND CONTEXT BACKGROUND OPTIV THREAT ACTOR INTEL SERIES #2 | NORTH KOREA’S CRIMINAL HACKERS 5 INFRASTRUCTURE Infrastructure in North Korea is poor to non-existent especially outside Pyongyang. Nighttime satellite imagery of the Korean Peninsula show bright swathes of artificial light in South Korea and China with darkness abruptly beginning at the DMZ in the south and the Yalu River in the north. Another example of the poor North Korean infrastructure is the Ryugyong Hotel in downtown Pyongyang. The construction project began in 1987 but was suspended for two decades due to lack of funding, leaving a concrete skeleton on display. Since 2012, the façade of the building was completed, enclosing the space in glass and steel. But the interior remains unfinished. North Korea INFORMATION Analyzing the accessibility of the Internet in North Korea is a difficult task. North Korea doesn’t appear in the NGO Freedom House, Freedom on the Net report (2016), or the ICT index (International Telecommunications Union, 2017). The DPRK exerts tights control over Internet access. Some North Koreans have access to Kwangmong, which is the name given to the walled garden Internet available in the DPRK (Fisher, 2015). Internet backbone support is delivered by internet service providers based in Russia and China. Since 2009, North Korean Internet access relies on Star Joint Venture Co., a joint business venture between North Korean government-owned Post and Telecommunications Corporation and Thailand-based Loxley Pacific. Until recently, nearly all of North Korea’s internet traffic, including Star Joint Venture’s, was dependent on and routed through China-based China Unicom. In October 2017, researchers from Dyn Research and 38 North observed route announcements to several known North Korean IP ranges coming from Russian Internet carrier and service provider Transtelecom (Chirgwin, 2017). Russian Internet support and redundancy came at a time when Chinese and North Korean diplomacy began to falter as a more aggressive North Korean regime isolated itself further from the rest of the world, prompting China to pull diplomatic and economic initiatives out of North Korea. This shift is assessed to have allowed Russia to continue to further its own interests by aligning itself closer with North Korea as China was reducing its footprint. OPTIV THREAT ACTOR INTEL SERIES #2 | NORTH KOREA’S CRIMINAL HACKERS 6 CONTROLS ON DISSENT The kinds of hacker groups that arose organically in liberal Western democracies such as Cult of the Dead Cow, l0pht Heavy Industries, or the Chaos Computer Club would be quashed by DPRK authorities. State control of media is absolute in North Korea. As a protest measure, South Korea groups have taken to loading digitized TV shows, music, and movies on USB thumb drives, attaching them to balloons, and letting them drift north across the border (Halvorssen & Lloyd, 2014). Even elite regime members are not immune from purges. Jang Sung-Taek, uncle of Kim Jong-Un and high-ranking member of the WPK, was arrested in December 2013 and subsequently executed. Jang’s images were edited out in a Stalinist-style purge. His arrest was reported to be for a number of counter-revolutionary failings, but was also a political tool for Kim to consolidate control. The punishment for politically-motivated crime in North Korea is imprisonment of the accused and three generations of his/her family (Bureau of Democracy, Human Rights and Labor, 2017). The draconian punishments meted out by the North Korean government only stem the flow of defections to a limited degree.