South Korea has announced sanctions against 15 individuals and one entity from North Korea involved in cybercrimes, including large-scale cryptocurrency heists.

The move comes amid rising concerns about North Korea’s use of cyber operations to fund its weapons programs and evade international sanctions.

The Ministry of Foreign Affairs of South Korea particularly disclosed in a statement released on December 26 that the sanctioned individuals are linked to Bureau 313, an organization under the Workers’ Party of Korea’s Machine-Building Industry Department.

This bureau, which has been under United Nations Security Council sanctions since 2016, plays a significant role in overseeing North Korea’s weapons production, including its ballistic missile program.

According to the ministry, these operatives are often dispatched to countries such as China, Russia, Southeast Asia, and Africa, where they operate under disguised identities to secure employment in IT firms.

Many of these individuals infiltrate IT networks, manipulate company operations, and, in some cases, conduct cryptocurrency thefts. One such individual, Kim Cheol-min, reportedly infiltrated IT firms in the US and Canada, transferring large sums of foreign currency back to North Korea.

Additionally, one sanctioned entity is also known to send North Korean IT personnel overseas to secure illicit funds for Pyongyang’s regime and military operations.

Notably, the reasons behind the sanctions of these North Korean perpetrators are quite evident. Recent reports from blockchain analytics firm Chainalysis reveal that North Korean hackers stole approximately $1.34 billion worth of cryptocurrency across 47 incidents last year.

This significant figure represents 61% of the total global cryptocurrency theft in 2023, marking a sharp increase both in terms of frequency and scale.

According to the report, these attacks are often meticulously planned, with operatives using advanced Tactics, Techniques, and Procedures (TTPs) to breach corporate networks and extract valuable digital assets.

The Chainalysis report also points out a concerning trend—many of these thefts are facilitated by North Korean IT workers embedded in global tech firms, including crypto and Web3 companies.

These operatives often use false identities, third-party intermediaries, and remote work opportunities to gain unauthorized access to sensitive systems.

Once inside, they manipulate networks, compromise security protocols, and exfiltrate funds in the form of cryptocurrencies, which are then laundered through complex blockchain transactions to evade detection.

While the sanctions represent a significant step, North Korea’s cyber capabilities will likely remain a persistent threat without coordinated global oversight and advanced cybersecurity measures. The South Korean government wrote:

Our government will continue to work with the international community to block North Korea’s illegal cyber activities with a high level of alertness. This independent sanction is scheduled to take effect from 00:00 on Monday, December 30 through publication in the Official Gazette. Financial and foreign exchange transactions with the targets designated as targets of this independent sanction require prior approval from the Financial Services Commission or the Governor of the Bank of Korea

Featured image created with DALL-E, Chart from TradingView

109 +