North Korea’s leader Kim Jong-un is targeting billions of dollars in cyberspace.Image: KCNA via KNS / Uncredited
North Korea is militarily isolated and economically sanctioned – but according to experts, the country is one of the most active players in the world in cyberspace. The regime also uses this to finance its military programs.
March 8, 2026, 8:40 p.mMarch 8, 2026, 8:40 p.m
Anna Von Stefenelli / watson.de
Digital attacks have long been part of geopolitical power politics. States use hacker groups to spy and destabilize other countries, but also apparently as a source of income. While states like Russia and China are clearly pushing ahead with hybrid war, one country often remains in the shadows in reporting: North Korea.
Sanctions are severely restricting the isolated state’s economy, but another area is growing rapidly: cyber operations. They are now seen as an important component of the North Korean strategy for raising money – and thus continuing military programs.
Great Britain sees North Korea as a key cyber threat
According to security experts, North Korea is now one of the most important state actors in global cyberspace. “The UK views North Korea as a serious cyber threat alongside China, Russia and Iran; “They are one of the four main players,” James Sullivan, cyber director of the London-based defense think tank Royal United Services Institute (RUSI), told the news agency Yonhap on the sidelines of a security conference in Seoul.
Even though London is currently paying more attention to cyber activities from Russia and China, Pyongyang remains a significant player. The regime has in the past deliberately attacked critical infrastructure in order to achieve financial profits. In this way, the regime supports its military programs, explained Sullivan.
North Korea uses cryptocurrencies as a source of income for the regime
International security authorities and analysts have seen North Korean hackers as particularly active in attacks on cryptocurrency platforms for years. According to several cybersecurity analyses, groups from North Korea are specifically attacking crypto exchanges, banks and IT service providers. The goal is to steal large sums of money to finance various government programs.
A United Nations expert panel also came to this conclusion. UN reports say so ABC News noted that North Korean hackers have stolen billions of dollars worth of cryptocurrencies over the years. Part of this income is said to have flowed directly into the country’s missile and nuclear program.
US authorities such as the National Security Agency and the Cybersecurity and Infrastructure Security Agency regularly warn about North Korean hacker groups. The so-called is particularly frequently mentioned Lazarus groupwhich is said to be responsible for several large-scale cyber attacks.
Hackers: Cooperation with Russia could increase
Security experts are also watching the growing military cooperation between Russia and North Korea with concern. “If Russia and North Korea cooperate militarily, the assumption of cooperation in cyberspace is not unreasonable.”said Sullivan. “Although there is not much evidence of this at the moment, the likelihood increases as they pursue the same goals.”
Relations between Moscow and Pyongyang have intensified significantly in recent years. According to reports, North Korea has sent around 15,000 soldiers to support Russia in the war against Ukraine since October 2024.
Given the increasing threat, Sullivan particularly emphasizes the importance of defense and international cooperation in cyberspace.
States must make their digital infrastructure more resilient and cooperate more closely with international law enforcement authorities. At the same time, offensive cyber capabilities could also play a role in deterring attacks.
In addition to North Korea, security experts are also closely monitoring other states in cyberspace. Iran in particular could rely more intensively on digital attacks in the future. “In the short term, Iran will focus heavily on ongoing conventional military conflicts,” Sullivan said.
However, if the situation stabilizes, the cybersecurity expert expects Tehran to increasingly resort to other means. These include cyberattacks, disinformation campaigns and the use of hacktivist networks to disrupt Western systems.