Kim Jong Un of North Korea. Pyongyang, Korean Central News Agency = Yonhap News.

The Multinational Sanctions Monitoring Team (MSMT), formed by 11 Western countries including South Korea, the United States, and Japan to support the implementation of international sanctions against North Korea, released its second report on violations of these sanctions on the 22nd.

The MSMT was launched in October of the previous year to fill the monitoring gap in North Korean sanctions after the UN Security Council's Panel of Experts under the Sanctions Committee against North Korea concluded its activities in April due to Russia's obstruction.

The first MSMT report, published in May, focused on military cooperation between North Korea and Russia, while this second report addresses North Korea's illicit cyber activities.

According to the second report, North Korea stole virtual assets worth $2.84 billion (approximately 4 trillion won) from January of last year to September of this year. The amount stolen reached approximately $1.65 billion this year alone.

North Korean cryptocurrency hacking. Yonhap News. 

◇ North Korea operates diverse cyber organizations under its party, military, and government… utilizes Cambodian organizations for money laundering

The report points out that North Korea is strengthening its cyber operation capabilities for the purpose of generating revenue for the regime, and that most of these organizations are under entities subject to UN sanctions, such as the General Reconnaissance Bureau, the Ministry of Atomic Energy Industry, and the Munitions Industry Department.

Military-affiliated organizations identified include the Research Institute No. 110, Research Institute No. 63, Unit 970, Liaison Office No. 772, Korea Expo Joint Company, Liaison Office No. 414, and Research Institute No. 227, all under the General Reconnaissance Bureau.

Within the administrative branch, APT37 affiliated with the Ministry of State Security, Amnok River Technology Development Company affiliated with the Ministry of Social Security, Korea Mangyongdae Computer Technology Company affiliated with the Ministry of Atomic Energy Industry, and Bureaus No. 53 and 61 affiliated with the Ministry of Defense were identified.

Under the Workers' Party, organizations such as Directorate 313, Directorate 75, and the Second Academy of Natural Sciences, affiliated with the Munitions Industry Department, exist.

The report analyzes that these cyber organizations under the party, military, and government have a highly complex and overlapping command structure.

North Korean cyber organizations have used tactics such as disguising themselves as investors, businessmen, or recruiters to contact virtual asset exchanges in countries like the United Arab Emirates, Japan, India, and Singapore, and then inducing them to download malicious software.

North Korea is also cooperating with ransomware groups, including Russian ones, in its malicious cyber activities, and has sold data acquired through ransomware attacks to third parties.

There have also been instances where artificial intelligence (AI) tools like ChatGPT and DeepSeek are used to refine their methods.

North Korea is understood to launder stolen virtual assets and then cash them out through overseas brokers located in China, Russia, Hong Kong, and Cambodia.

The report points out that Chinese nationals or financial systems are significantly involved in this cashing-out process.

In particular, it mentions that a Cambodian organized crime syndicate, recently implicated in the kidnapping, confinement, and torture of South Koreans, has been used in the money laundering and cashing-out process.

North Koreans affiliated with North Korea's General Reconnaissance Bureau have used Huione Pay, a financial service of Cambodia's major financial services conglomerate Huione Group, which has been sanctioned by US and UK authorities, for money laundering and maintained close relationships with Huione Pay employees.

The US and UK governments have designated the Huione Group and others as 'transnational criminal organizations'. Although the Cambodian central bank revoked Huione Pay's license, the report states that Huione Pay continues to operate within Cambodia.

North Korean IT personnel in disguise. Yonhap News. 

◇ "1,000 to 2,000 North Korean IT personnel residing in 8 countries… earned up to $800 million last year"

The issue of income earned by North Korea's information and communication technology (ICT) personnel abroad was also discussed. The Security Council stipulates the prohibition of employment and the obligation to repatriate North Korean overseas workers.

Despite this, approximately 1,000 to 2,000 North Korean IT personnel are staying in at least 8 countries, including China, Russia, Laos, Cambodia, Equatorial Guinea, Guinea, Nigeria, and Tanzania.

China has the largest number, with 1,000 to 1,500 individuals, followed by Russia with 150 to 300. It is estimated that there is a possibility of employing 350 to 1,800 North Korean IT personnel in regions like Moscow, Ussuriysk, and Vladivostok this year.

These individuals generated an income of $350 million to $800 million last year by taking on projects related to AI, blockchain, and the defense industry in countries like the US, Germany, Portugal, and the UK, and it was revealed that they remit about half of their income to North Korea.

As the US recently intensified its crackdown on the activities of North Korean IT workers, North Korea is reportedly expanding its operations to small and medium-sized IT companies in Europe.

They created virtual personas by generating synthetic information or purchasing/renting existing accounts, and then secured work from companies that allow remote work.

North Korea's cyber activities were not solely for financial gain. The report states that North Korea has stolen military, scientific, and energy-related information and technology from countries including the US, UK, South Korea, and China through cyberattacks.

The report included attempts to infiltrate South Korea's cyber infrastructure through security authentication software, collection of information in South Korea's construction sector through mass distribution of malware, theft of research information from Chinese drone manufacturer DJI, theft of information from South Korea's defense industry, and theft of information about South Korean contacts related to North Korea.

In a joint statement released along with the report, the MSMT stated, "We encourage all UN member states to raise awareness of North Korea's malicious cyber activities and to hold those involved accountable for violations of UN Security Council resolutions through sanctions and other means."

It continued, "We urge the Security Council to restore the Panel of Experts with the same authority and structure as before its dissolution," and emphasized, "We will continue our efforts to monitor the implementation of UN Security Council resolutions against North Korea and to identify ongoing violations and evasions of sanctions."

North Korean cyber activities. Yonhap News TV. 

Yonhap News