UN experts: North Korea stealing millions in cyber attacks

North Korea is continuing to steal hundreds of millions of dollars from financial institutions and cryptocurrency firms and exchanges, illicit money that is an important source of funding for its nuclear and missile programs, U.N. experts said in a report quoting cyber specialists.

The panel of experts said that according to an unnamed government, North Korean “cyber-actors stole more than $50 million between 2020 and mid-2021 from at least three cryptocurrency exchanges in North America, Europe and Asia, probably reflecting a shift to diversify its cybercrime operations.”

And the experts said in the report’s section on cyber activities obtained Sunday by The Associated Press that an unidentified cybersecurity firm reported that in 2021 the North’s “cyber-actors stole a total of $400 million worth of cryptocurrency through seven intrusions into cryptocurrency exchanges and investment firms.”

These cyberattacks “made use of phishing lures, code exploits, malware, and advanced social engineering to siphon funds out of these organizations’ internet-connected ‘hot’ wallets into DPRK-controlled addresses,” the panel said, using the initials of the country’s official name, the Democratic People’s Republic of Korea.

The cryptocurrency funds stolen by the DPRK cyber actors “go through a careful money laundering process in order to be cashed out,”″ the panel of experts monitoring sanctions on North Korea said in the report to the U.N. Security Council.

A year ago, the panel quoted an unidentified country saying North Korea’s “total theft of virtual assets from 2019 to November 2020 is valued at approximately $316.4 million.”

In the executive summary of the new report, the experts said North Korea has continued to develop its nuclear and ballistic missile programs.

“Although no nuclear tests or launches of ICBMs were reported, DPRK continued to develop its capability for production of nuclear fissile materials,” the panel said. Those fissile materials — uranium or plutonium — are crucial for a nuclear reaction.

The experts noted “a marked acceleration” of North Korean missile launches through January that used a variety of technology and weapons. The experts said North Korea “continued to seek material, technology and know-how for these programs overseas, including through cyber means and joint scientific research.”

A year ago, the panel said North Korea had modernized its nuclear weapons and ballistic missiles by flaunting United Nations sanctions, using cyberattacks to help finance its programs and continuing to seek material and technology overseas for its arsenal including in Iran.

“Cyberattacks, particularly on cryptocurrency assets, remain an important revenue source” for Kim Jong Un’s government, the experts monitoring the implementation of sanctions against the North said in the new report.

In addition to its recent launches, North Korea has threatened to lift its four-year moratorium on more serious weapons tests such as nuclear explosions and launches of intercontinental ballistic missiles.

The Security Council initially imposed sanctions on North Korea after its first nuclear test explosion in 2006 and toughened them in response to further nuclear tests and the country’s increasingly sophisticated nuclear and ballistic missile programs.

The panel of experts said North Korea’s blockade aimed at preventing COVID-19 resulted in “historically low levels” of people and goods entering and leaving the country. Legal and illegal trade including in luxury goods “has largely ceased” though cross-border rail traffic resumed in early January, it said.

The panel has previously made clear that North Korea remains able to evade sanctions and to illicitly import refined petroleum, access international banking channels and carry out “malicious cyber activities.”

U.N. sanctions ban North Korean coal exports and the experts said in the new report that although coal exports by sea increased in the second half of 2021, “they were still at relatively low levels.”

“The quantity of illicit imports of refined petroleum increased sharply in the same period, but at a much lower level than in previous years,” the panel said, adding that direct deliveries by non-North Korea tankers has ceased and only tankers from the North delivered oil, “a marked change of methodology” probably in response to COVID-19 measures.

The experts said North Korea also continues to evade maritime sanctions “by deliberately obfuscated financial and ownership networks.”

While the humanitarian situation in the country continues to worsen, the panel said the almost complete lack of information from the country makes it difficult to determine the “unintended humanitarian consequences of U.N. sanctions affecting the civilian population.”