North Korea

A Study of North Korea’s Cyber Warfare: Actors, Tactics, and AI Integration

Abstract:

North Korea’s cyber threat operations have emerged as one of the most advanced and aggressive in the world. Over the past decade, the country has built a sophisticated cyber warfare capability, primarily aimed at financial gain, intelligence gathering, and disrupting adversaries. North Korea’s cyber activities are largely driven by its isolation from the global economy and its need to fund its regime amid international sanctions. These operations are conducted by highly skilled state-sponsored groups, most notably the Lazarus Group and APT38, both believed to be controlled by North Korea’s Reconnaissance General Bureau (RGB), the country’s primary intelligence agency. 

Published In

Volume 24, Issue 2

Written By

Chuck Easttom

Four Foreign Forces: A CTI Analysis of APTs Targeting the U.S.

Abstract:

This paper analyzes the cyber threat landscape posed by advanced persistent threats (APTs) attributed to China, Iran, North Korea, and Russia. It focuses on active groups and their cyber activities targeting the United States. Utilizing cyber threat intelligence data from authoritative sources such as Cybersecurity and Infrastructure Security Agency (CISA), Office of the Director of National Intelligence (ODNI), Mandiant, and MITRE, this study identifies twelve key APT groups attributed to the four adversarial nations and creates a quick profile for each nation and group. It explores the common techniques and sub-techniques employed by each nation and then across all four nations. Examination of these nations, groups, and techniques then informs a list of six actionable mitigations that will enhance cybersecurity defenses targeting these adversarial groups in an efficient manner: User Training, Restrict Web-Based Content, Privileged Account Management, Network Intrusion Prevention, Execution Prevention, and Antivirus/Antimalware.

Published In

Volume 23, Issue 4

Written By

Bryon Miller

South Korea’s Options in Responding to North Korean Cyberattacks

Abstract:

North Korea has increasingly mounted cyberattacks against South Korea. This paper first examines the dramatic differences between North and South Korea in cyberspace and the history of North Korean cyberattacks. Most of these attacks are easy to attribute for three reasons: they often come from addresses known to be used by North Korea; they often occur on Korean anniversaries; and they often use similar methods and attack code. In this article, the authors discuss possible responses by South Korea. Responses to these attacks begin with invoking  international  law  and  imposing  sanctions.  Next,  South  Korea  can  strengthen  its defences by improving coordination between the government and the private sector. Finally, South Korea could, justifiably, launch counterattacks.

Published In

Volume 15, Issue 4

Manipulating the Architecture of Cultural Control: A Conceptual Model for Strategic Influence Operations in North Korea

ABSTRACT

The deep structural and cultural changes taking place in North Korea provide an opportunity to conduct influence operations to shape that country’s culture and society, either to destabilize the government or to prepare the population for a regime change. This paper presents a conceptual model of how contradictions between top down, imposed culture and organic, indigenous culture can be exploited to destabilize the system, and eventually re-pattern the culture.  The process includes the following steps: identification of the cultural type; understanding relevant cultural forms; identification of vulnerable targets; evaluation of the information system; identification of effective elements of persuasion; mapping of the architecture of social control; and introduction of new “attractors” to damage or destroy the constituent cultural myths.

Published In

Volume 4, Issue 1

Written By

Montgomery McFate

Journal of Information Warfare

The definitive publication for the best and latest research and analysis on information warfare, information operations, and cyber crime. Available in traditional hard copy or online.

Keywords

(

2

3

4

8

9

A
AI
APT

a

B

C
C2
C2S
CDX
CIA
CIP
CPS

D
DNS
DoD
DoS

E

e

F

G

H

I
IA
ICS

i

J

K

L

M

N

O

P
PDA

Q

R

S
SOA

T

t

U

V

W

X
XRY

Y

Z

Quill Logo

The definitive publication for the best and latest research and analysis on information warfare, information operations, and cyber crime. Available in traditional hard copy or online.

SUBSCRIBE NOW

Get in touch

Registered Agent and Mailing Address

  • Journal of Information Warfare
  •  ArmisteadTEC
  • Dr Leigh Armistead, President
  • 1624 Wakefield Drive
  • Virginia Beach, VA 23455

 757.510.4574

 JIW@ArmisteadTec.com