N. Korea's pursuit of money makes it 'unique' state actor of cyber attacks: US official

WASHINGTON -- North Korea is one of a few nations that pose a threat to cyber security but stands out as an "unique" country that steals money, a senior official from the US Department of Justice said Thursday.

John Demers, assistant attorney general for national security, also noted the communist state may be getting support for its illicit cyber activities from China, in terms of know-how and protection.

"A lot of it is getting money, getting cash. So on the cyber side very, you know, prominent theft from the bank of Bangladesh through a cyber bank robbery, basically," Demers said.

He was referring to the theft of $81 million from the Bangladesh central bank in 2016 by a group of North Korean hackers known as Lazarus.

He spoke remotely at a webinar hosted by a Washington-based think tank, the Center for Strategic and International Studies (CSIS).

Demers noted it was not surprising to see a country like North Korea develop cyber capabilities, which he called a "very asymmetric form of power" that even a small nation state can use effectively.

"And so, like we see out of Iran, for instance, the North Koreans have developed that capability. But almost uniquely among the countries that have that capability, as I said, they've used it really to steal banks and money," he said

"That's not really the behavior we see from China or Russia, or even Iran, despite the Iran sanctions. North Korea is kind of unique in that way," added Demers.

Victor Cha, who holds the Korea Chair at CSIS, noted the initial fears were that the communist state would use its cyber capabilities as destructive means.

"When we first started looking at North Korea's cyber capabilities...one of the things we noticed back then was that a lot of this cyber expertise and capability and training was taking place in the same units of the government that were responsible for the prosecution of terrorist attacks, and things of that nature," said Cha.

"I guess the good news, to the extent that there is ever good news with North Korea, is that they appear not to be doing that.

It's theft. It's basically theft of hard currency," he added.

Demers noted the North's pursuit of cash may derive from various sanctions imposed on the impoverished nation.

"If you look over the last two years, we have done about 13, 14 cases that involve North Korea, which is a very respectable number, and I think attests to . . . a sort of need for hard currency, and then, two, their desire to evade some of the sanctions, in particular on missile parts and nuclear proliferation items," he said at the virtual seminar, part of the center's Capital Cable series.

The Justice Department official said the North may be getting help from China.

"In addition to the money laundering, which actually supports some of the North Korean cyber operations because it helps them launder their money, there is support through, you know, Chinese cyber infrastructure. There's likely support in terms of sharing expertise and training from the Chinese side," he said.

Earlier reports have suggested that North Korea may have up to 6,000 trained hackers based in other countries, including China.

"In my world, I see... (Chinese support in) expertise, infrastructure and actually, you know, the laundering and things like that, and definitely the sort of the protection of North Korean cyber activities," said Demers. (Yonhap)