NK working with Russian cybercriminals: Sullivan

North Korea is cooperating with cybercriminals around the world, including those from Russia, US national security adviser Jake Sullivan said, amid heightened cybersecurity concerns around the world due to Russia’s war with Ukraine.

“All I can say, generally, is that North Korea’s cyber capabilities have been manifest in the world and they work with all kinds of cybercriminals around the world, including Russian cybercriminals,” Sullivan told the press briefing on Tuesday in Washington, when asked about connection between the North and Russia’s cyberhacking organizations.

Sullivan did not elaborate further, saying “I’ve got nothing further for you on that today.”

His remarks came after US President Joe Biden on Monday warned American businesses to take precautions amid “evolving intelligence” that Russia could launch cyberattacks against American companies and critical infrastructure.

In a report released by Harvard University’s Belfer Center for Science and International Affairs last week, Alex O’Neill, an associate of the Korea Project at the center, said the North has long collaborated with foreign cybercriminals, including Russian-language actors, which helps the regime to enhance its capabilities and to allocate resources more efficiently.

“North Korean hackers appear to have engaged in cyberspace with foreign criminals to obtain advanced tools and organize collection of in-country payouts. The dominance of the Russian-speaking cybercriminal underground makes it a logical target for collaboration,” he said.

O’Neill noted there are many reasons why Russian-speaking forums appeal to foreign cybercriminals, including Russian authorities’ “strategic negligence” toward cybercriminal activity whose victims lies outside the Commonwealth of Independent States, an organization of former Soviet Union countries. 

“The totality of these elements -- highly active forums, advanced offerings, sophisticated groups open to collaboration, and near-free rein from the state -- has made the Russian-language cybercriminal underground a desirable space for foreign actors seeking partners,” he said. “The Russian-speaking underground’s financial orientation and global accessibility is naturally attractive to North Korean financially motivated actors.”

North Korea’s rapidly growing cyberthreat stokes concern here as well. The Defense Ministry on Monday raised the national cybersecurity alert level by a notch to Level 3, the third-highest in the five-tier system. The National Intelligence Agency also elevated its own cybersecurity level to Level 2, the second lowest in the four-tier system.

The decision was amid concerns that North Korea’s threats from the regime’s repeated ballistic missile launches could be expanded into cyberspace, as well as Russia’s war in Ukraine that raised cyber risks worldwide.

The spy agency also expressed concern that North Korean hackers could attempt to steal policy documents of South Korea’s incoming administration, which is set to take office on May 10.  

By Ahn Sung-mi (sahn@heraldcorp.com)