North Korean hackers operating secretly in China, says defector

By JOSEPH FITSANAKIS | intelNews.org
An underground network of North Korean hackers are conducting complex cyberattacks against worldwide targets from Chinese cities without the knowledge of Beijing, according to a former professor who trained them. Kim Heung-Kwang was a professor of computer science in North Korean capital Pyongyang, until his defection in 2004. He told CNN on Tuesday that part of his job was training members of North Korea’s elite cyberintelligence corps, whose task was to compromise computer systems around the world. Kim alleged that some of the hackers joined a specialized outfit called Bureau 121. It was established in complete secrecy in 1995 and ten years later it began sending its operatives abroad, especially in northern China. According to Kim, Bureau 121 set up a complex network of hackers in the Chinese city of Shenyang, in northern China’s Liaoning Province. Shenyang is the largest Chinese city near North Korea, and Bureau 121 operatives were allegedly able to effortlessly blend in the sizeable Korean community there. The former professor told CNN that the hackers “entered China separately” over time, “in smaller groups […], under different titles” such as officer workers, trade company officials, or even diplomatic personnel. They operated like typical spies, working regular jobs by day and “acting on orders from Pyongyang” by night, said Kim. They gradually set up an underground “North Korean hacker hub”, operating secretly in Shenyang for several years, relocating from place to place in order to shield their activities from computer security experts. Kim told CNN that Shenyang’s bustling, money-driven life and its good Internet facilities made it easy for Bureau 121 members to work secretly on several projects that required sophisticated telecommunications infrastructure. North Korea lacks China’s telecommunications network capabilities, said Kim, which is why Pyongyang decided in the early days of the Internet to transport its hackers to Shenyang. He added that Bureau 121 has rolled back considerably its overseas operations in recent years, due to the advancement of high-speed telecommunications networks in North Korea; but some North Korean hackers are still active in northern China, he said.