N. Korea's hacking capabilities ranked 4th globally, behind US, China and Russia
Stolen virtual assets funneled into nuclear and missile programs
Lawmaker urges Seoul to abandon 'submissive' policy toward Pyongyang
"It is now fair to say that North Korea's hacking capabilities have reached world-class levels. Last year, the number of cyberattack attempts targeting our military reached 18,951 — the highest in the past five years. An estimated 89 percent of global virtual asset hacking losses this year are attributed to North Korea-linked groups. Yet the South Korean government's awareness of this threat is alarmingly complacent. We must build a pan-government control tower right now and invest heavily in cultivating white-hat hackers."
People Power Party lawmaker Park Chung-kwon said North Korea's cyber offensive capabilities have risen to the top tier globally, while the South Korean government's response has failed to keep pace. Park argued that because North Korea is channeling stolen virtual assets into nuclear and missile development, South Korea must urgently strengthen its national cybersecurity framework.
The Herald Business sat down with Park on Thursday at the National Assembly Members' Office Building to discuss North Korea's hacking capabilities, how its cyber units operate, the state of South Korea's cybersecurity and what should be done about it.
Park was born in 1986 in Hamhung, South Hamgyong Province, North Korea, and graduated from a gifted school known as the No. 1 High School before completing studies at Kim Jong-un University of National Defense. Park later worked at a munitions factory producing warheads for intercontinental ballistic missiles. After defecting to South Korea in 2009, Park earned master's and doctoral degrees from Seoul National University and spent seven years as a researcher at Hyundai Steel. Park entered politics in 2023 following a recruitment offer from the People Power Party and was elected to the 22nd National Assembly on the proportional representation list.
A member of the National Assembly's Foreign Affairs and Unification Committee, Park assessed North Korea's hacking capabilities as "roughly fourth in the world, after the United States, China and Russia — and its hacker units are evaluated at about that level as well." Park added that North Korea has built "a highly specialized organizational structure broken down by hacking objective," with groups including Lazarus, Andariel and Kimsuky operating under the Reconnaissance General Bureau.
Park also described the hacker training curriculum experienced firsthand in North Korea. "At Kim Jong-un University of National Defense, computer engineering was compulsory through the second year regardless of major — and the very first chapter was on hacking," Park said. "The stated purpose of hacking introduced in that course was to neutralize a US carrier strike group, but more recently it has been repurposed as a funding stream to evade sanctions against the North."
"In the past, North Korea trained all-around hackers. Now it produces specialists and deploys them unit by unit," Park said. "The weapons built with stolen funds ultimately become a threat to us, yet I see no one in the government with the will to recognize this and stop it."
Park also raised concerns about allegations that Elise Huang, suspected of spying for China, exploited her ties to Nvidia CEO Jensen Huang to smuggle at least $7.5 billion worth of American AI chips into China. "Given that North Korea cannot produce GPUs on its own, there is a fairly high likelihood that those chips could end up flowing into the North," Park said. The following is the full text of the interview.
— How would you assess North Korea's hacking technology and operational capabilities?
North Korea has long regarded cyberwarfare as an asymmetric capability to offset its conventional military inferiority. Even as its people go hungry, the regime has concentrated national resources on developing nuclear and missile programs and on training cyberwarfare personnel. While North Korea's overall cyber capabilities fall short of those of the United States and China, its ability to penetrate specific targets and steal virtual assets is considered a top-tier global threat. In the first half of this year alone, North Korea-linked hacking activity was recorded in 99 cases — far outpacing China with 33 and Russia with 26 — and South Korea was the most frequently targeted country, with 19 cases.
— How is North Korea's hacking apparatus organized?
North Korea's hacking organizations are not civilian criminal groups — they are cyberwarfare units directly cultivated and operated by the state. A range of groups, including Lazarus, Andariel and Kimsuky, operate under the Reconnaissance General Bureau, with missions divided across functions ranging from stealing military secrets to generating foreign currency. North Korea identifies mathematically and scientifically gifted children from an early age and grooms them as cyber specialists. According to recently disclosed testimony, roughly 150 to 200 top students are selected each year, with Kim Chaek University of Technology and Mirim University among the best-known training institutions. Elite hackers are rewarded with privileges unavailable to ordinary citizens — residency in Pyongyang, housing assignments and foreign-currency bonuses — while personnel deployed abroad operate under strict surveillance and intense performance pressure, handing over a significant share of their earnings to the regime.
— What is the strategic and economic weight of hacking within the North Korean regime?
Hacking is no longer a simple foreign-currency earner for North Korea — it is now a core funding stream underpinning nuclear and missile development. According to the Multilateral Sanctions Monitoring Team, North Korea stole approximately $2.84 billion in virtual assets between January 2024 and September 2025. About 89 percent of virtual asset hacking losses recorded this year are estimated to be North Korea-linked. The money Pyongyang secures by evading international sanctions ultimately feeds the nuclear and missile threats aimed at South Korea.
— As North Korea's cyberattacks grow increasingly sophisticated, how capable is the South Korean government's response?
South Korea is a world-class IT power, yet its national cybersecurity framework has exposed serious vulnerabilities. A hack of the Korea National Diplomatic Academy is estimated to have leaked up to 10,000 records belonging to diplomats and others, and in an unprecedented incident, the passenger manifest for the presidential aircraft was also exposed externally. The Ministry of Foreign Affairs has tried to explain it away as a leak rather than a hack — but if it was not a hack, that means the basic security management system has simply collapsed. President Lee Jae Myung, reacting to the Coupang Inc personal data breach, said companies should be made to feel they could go under if they get it wrong and called for severe penalties. A president who demands harsh accountability from private companies must now answer what responsibility he will take for the leak of documents at the highest level of national security.
— Is the government's conciliatory posture toward North Korea affecting its cybersecurity response?
Rather than responding firmly to North Korean provocations, the government's first instinct is to watch how Pyongyang reacts. In September, soldiers had their feet severed by North Korean landmines, yet the president described it as an "unexpected accident," and Unification Minister Jeong Dong-young opposed imposing independent sanctions on North Korea over its cyber activities. One cannot help but ask which country's security this government is responsible for. North Korea is looting global financial markets, yet our government cannot even reach a consensus on whether to sanction it. Submission to North Korea is not peace. True peace means making North Korea afraid to provoke in the first place, and the government must abandon its policy of submission toward the North.
— How aware is the South Korean public of the threat from North Korean cyberattacks?
North Korea's nuclear weapons and missiles are visible — cyberattacks are not, which makes it hard for people to feel the danger. But with finance, healthcare and transportation now deeply dependent on digital infrastructure, a single cyberattack could paralyze daily life for the entire population. The government projects an attitude that easing sanctions and pursuing dialogue will bring peace, but rather than repeating vague unification slogans, it should be clearly communicating the realities of North Korea's nuclear and missile development and its human rights abuses. Supporting the North Korean people and responding firmly to Kim Jong-un's provocations are not contradictory goals.
— What roles should the government and the National Assembly play on security issues?
The most urgent priority is establishing a national cybersecurity control tower. North Korea attacks in an organized, state-directed manner, yet our government lacks not only an effective response but even the will to respond. This year's national audit laid bare just how lenient the Lee Jae Myung administration is toward North Korean provocations and how passive it is in defending South Korea's security. Cultivating white-hat hackers is a project the government could pursue if it simply chose to — it needs to commit the budget, offer top-tier compensation and build up that talent pool. The National Assembly must also raise public awareness of these issues. I intend to treat North Korea's nuclear and missile programs and its cyberattacks not as separate problems but as a single security threat, and to translate the findings from the national audit into budget decisions and legislation.
mp1256@heraldcorp.com
raining@heraldcorp.com
