North Korea is believed to have multiple cyber units under the umbrella of the Korean People’s Army’s General Reconnaissance Bureau.
According to Kim Heung-kwang, who represents a group of defectors from North Korea called “North Korea Intellectuals Solidarity” and used to be a university professor in the North, [cyber] units were organized in the North in the 1990s under instructions from (then) General Secretary Kim Jong Il. The North, which is poor in resources and funds, believed that cyberwarfare would allow it to compensate for a gap in military power [with other countries]. Kim Heung-kwang said Worker’s Party of Korea General Secretary Kim Jong Un is further strengthening the units.
It is believed that there had been only one unit under the umbrella of the General Reconnaissance Bureau until around 2009. But currently the unit seems to be divided into several units each with a different purpose, such as monetary theft and destruction of social infrastructure. Kim Heung-kwang believes a total of 5,000 people are working in the units. Hacker groups, such as Lazarus, which is believed to have been involved in the 2017 cyberattack to demand ransom from banks and companies around the world, and Beagle Boys, which is recently stepping up its activities, are working under the supervision of separate units.
Kim Heung-kwang says the global coronavirus pandemic has “provided an ideal environment for North Korean hackers” because hacking becomes easier by pretending to send COVID-19-related “emergency information.” North Korea is believed to be continuing to step up cyberattacks as the country has also been hit by U.S. economic sanctions.