Students move from elite middle schools to Pyongyang computer academies to university

Hackers hold military status, receive rations and Pyongyang residency — but families serve as leverage

Seoul has sanctioned Mirim University and Geumseong Academy, citing their role in producing North Korea's hackers

US Justice Department prosecutor Tracy Wilkinson speaks at a press conference in Los Angeles on Sept. 6, 2018 (local time), announcing the indictment of North Korean hacker Park Jin-hyok, 34, over a series of cyberattacks including the 2014 Sony Pictures hack, along with accompanying sanctions. Park, a computer programmer, is a member of the Lazarus Group — North Korea's most notorious hacking organization — and was employed by Chosun Expo Joint Venture, a front company used by Pyongyang. [AP via Yonhap]
US Justice Department prosecutor Tracy Wilkinson speaks at a press conference in Los Angeles on Sept. 6, 2018 (local time), announcing the indictment of North Korean hacker Park Jin-hyok, 34, over a series of cyberattacks including the 2014 Sony Pictures hack, along with accompanying sanctions. Park, a computer programmer, is a member of the Lazarus Group — North Korea's most notorious hacking organization — and was employed by Chosun Expo Joint Venture, a front company used by Pyongyang. [AP via Yonhap]

North Korean defectors have described how Pyongyang identifies mathematically gifted children at an early age and grooms them into cyber operatives, as the FBI pointed to North Korea as the force behind the $6.3 billion hack of Binance.

A defector who studied computer engineering in North Korea described the hacker recruitment pipeline in a phone interview Sunday. The defector, identified only as A, said students advance through a network of six-year gifted schools known as "No. 1 middle schools," one in each city, county and province, rising through the ranks based on ability until the top students reach Geumseong No. 1 Middle School or Pyongyang No. 1 Middle School.

At these schools, students receive systematic instruction in mathematics alongside machine language and programming languages including C, C++ and Java. At science and engineering universities such as Kim Chaek University of Technology, hacking competitions are held twice a year, and the top five or so students in each department form a "computer group" to practice penetrating virtual servers. Graduates are then assigned to the Ministry of Defense and the Reconnaissance General Bureau's departments focused on South Korea and the United States.

Another defector, identified as B, who had earned foreign currency through IT work abroad, described a parallel track. Students selected again from the No. 1 middle schools are sent to one of three computer-specialist schools in Pyongyang — including Geumseong Academy, B said, adding that IT workers and hackers "are classmates all the way through university." After that, roughly three military-run universities specializing in hacking provide separate training in data recovery, forensics and techniques for exploiting network vulnerabilities.

Hackers hold military status. B said that because soldiers live where they are posted, even those from the provinces can reside in Pyongyang, and the position comes with rations, a military service record and fast-tracked party membership. However, B added, discharge is difficult and the assignment means spending a career as an engineer — making it a less sought-after posting within the IT sector. Overseas, family members serve as leverage, and operatives are monitored through office closed-circuit television and around-the-clock surveillance software, B said.

On hacking groups such as Lazarus and Kimsuky, B said they are "all small teams" and likely represent successful cases among a larger pool of hacking units managed by two or three parent organizations. The US Justice Department indicted North Korean hacker Park Jin-hyok, a Lazarus member, in September 2018 on charges of orchestrating the Sony Pictures hack and other attacks. Park studied programming languages at a North Korean university before working for more than a decade as a programmer at the front company Chosun Expo Joint Venture.

B also said contacts inside North Korea had recently reported that even ordinary developers were using generative AI tools such as Claude and ChatGPT.

"Commercial AI is designed to filter out dangerous commands, but custom AI built by North Korea itself has no such guardrails — making it far more threatening," B said. The National Intelligence Service had previously warned that North Korea was using AI to sharpen its hacking capabilities.

The defectors' accounts align with the South Korean government's own assessments. In February 2023, when Seoul imposed its first independent cyber sanctions against the North, it placed Mirim University — formally the Command Automation University under the Korean People's Army General Staff — on the sanctions list. The university, founded in 1986, is believed to produce around 100 cyber specialists a year. That May, the government also designated Geumseong Academy as a sanctions target, stating that "a significant number of North Korea's IT workers and hackers are alumni of the academy."

The National Intelligence Service and the Joint Chiefs of Staff estimate North Korea's cyber workforce at roughly 8,400 personnel as of 2024.

B said South Korea's defenses have a critical gap: "There is no law or enforcement decree on software supply chain security," leaving institutional safeguards "completely unprotected." People Power Party lawmaker Park Chung-kwon, a North Korean defector, made a similar point at a press conference Tuesday, saying, "We must keep in mind that national security can be breached not only at the barrel of a gun but also through financial servers."


rimsclub@heraldcorp.com