Pyongyang’s cyberattacks reach civilians while Seoul remains unready, complacent
The Korean Herald Editorial
It began with a flicker on a smartphone screen. A counselor for North Korean defectors found her device suddenly wiped clean, her contacts hijacked and a fake “stress relief program” sent to friends through her account.
Days later, an activist’s phone met the same fate. Both had unknowingly become pawns in North Korea’s newest front: a conflict fought not with missiles or tanks, but with malware.
These attacks marked a disturbing evolution. The hackers were traced to Konni, a network tied to Kimsuky and other North Korean cyber units. They were not merely stealing data. They remotely controlled smartphones and personal computers, activating webcams and microphones to spy on their targets.
This was not espionage confined to government agencies or corporations, but surveillance intruding into private life. The virtual battlefield breached South Koreans’ living rooms.
For Pyongyang, cyberwarfare has become an asymmetric weapon as vital as its nuclear and missile programs. With international sanctions strangling its finances, hacking now doubles as an economic lifeline. The UN estimates that North Korean groups have stolen about $3 billion in cryptocurrency, funding everything from weapons development to regime survival.
But beyond money, the regime’s cyber strategy seeks to sow anxiety and distrust — a psychological offensive against a society it cannot conquer by force.
Artificial intelligence is rapidly amplifying that threat. Combined with human intelligence and social engineering, North Korea-linked groups now exploit deepfakes and AI-generated personas to infiltrate job networks and military systems abroad. As AI continues to evolve, so will the sophistication of Pyongyang’s intrusions.
South Korea, meanwhile, remains dangerously complacent. Despite decades on the front line of one of the world’s most enduring conflicts, South Korea’s cybersecurity posture remains fragmented and reactive.
Last month, the government acknowledged a massive breach of its core administrative network, the On-nara system, only after hackers had penetrated it, undetected, for nearly three years. When a US cybersecurity outlet exposed breaches of central ministries and telecom firms, officials confirmed the report two months later.
This pattern of denial and delay reveals a deeper institutional flaw. Responsibility for cyber defense is scattered among the National Intelligence Service, Ministry of National Defense, Ministry of Science and ICT and police. None of these agencies wield decisive authority. They defend institutional turf while North Korean hackers move swiftly across digital borders that bureaucrats cannot see. Critics argue that a centralized national cybersecurity command is long overdue.
Even as the threat escalates, resources are shrinking. Next year’s government budget for hacking countermeasures has been cut by 34 percent. Nearly half of South Korean companies have no cybersecurity budget at all, and most that do spend less than 5 million won ($3,400). Many still treat digital security as a discretionary expense rather than an existential necessity.
The cost of inaction reaches far beyond the IT sector. Attacks on telecom providers, card issuers and data firms have already shaken consumer confidence and disrupted markets. A successful strike on power grids or financial systems could paralyze the country.
The question is no longer whether North Korea can do it, but when, and whether South Korea will be ready when it happens.
The era when Pyongyang’s hackers merely stole information is over. They now seek to erase data, monitor civilians and destabilize society itself. Defending against that threat requires more than technical fixes. It calls for political will, institutional coherence and sustained investment to treat cyberspace as a critical frontier of national security.
A war without sound is still a war. South Korea cannot afford to remain cyber-defenseless. It must act now, before Pyongyang turns today’s silence into tomorrow’s blackout.
