South Korea’s top HUMINT agency probes potentially catastrophic data breach

July 29, 2024 by 1 Comment

North South KoreaIN A HIGHLY UNUSUAL move, authorities in Seoul have publicly acknowledged a data leak that may have resulted in the outing of a number of South Korean undercover human intelligence (HUMINT) operatives abroad. The South Korean Ministry of National Defense said on Sunday it was investigating an alleged link of highly sensitive data belonging to the Korea Defense Intelligence Command (KDIC).

Formed under American tutelage in 1946, KDIC is today considered South Korea’s most secretive intelligence agency. It operates under the Defense Intelligence Agency (DIA), which makes it part of the Ministry of National Defense’s chain of command. Unlike DIA’s civilian counterpart, the National Intelligence Service, KDIC rarely surfaces in unclassified news reporting, and it almost never issues press releases. Its operations primarily involve HUMINT activities, thus making it South Korea’s most active HUMINT-focused agency.

Predictably, KDIC’s primary intelligence target is North Korea. The agency gathers much of its intelligence on the North through an extensive network of undercover officers operating with diplomatic credentials. KDIC also handles non-official cover (NOC) operatives, who are located mostly in Asia. There have been periodic claims in the unclassified literature that some KDIC NOCs have operated inside North Korea at times –though such claims remain speculative.

On Saturday, the Seoul-headquartered Yonhap News Agency alleged that classified information relating to KDIC had been “leaked”. According to Yonhap, the leak included personally identifiable information about KDIC official and non-official cover personnel stationed abroad. The report claimed that the leak was discovered by South Korean authorities a month ago, and that the discovery had resulted in the recall of several KDIC undercover operatives serving overseas “due to concerns over their identities being exposed”.

The Yonhap report claimed that, according to an ongoing probe, the leak may have originated from a personal laptop computer belonging to a civilian KDIC employee. The employee has since claimed that the laptop had been hacked, but some investigators believe the suspect may have “intentionally left the laptop vulnerable to hacking by North Koreans”.

According to an official statement released on Sunday by the Ministry of National Defense, the case is “currently under investigation by military authorities”.

► Author: Joseph Fitsanakis | Date: 29 July 2024 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , ,

North Korean radio station known for sending coded messages to spies goes silent

January 15, 2024 by 2 Comments

North South KoreaNORTH KOREA APPEARS TO have suspended a long-standing radio station, known for broadcasting content targeted at South Koreans, which also aired encrypted messages intended for North Korean spies abroad. Radio Pyongyang was founded by Korean communist forces in the 1940s. In 1950 it formed part of the North Korean state’s official media propaganda arm.

Throughout the Cold War, Radio Pyongyang aired hundreds of hours of news and cultural content every week. The broadcasts were in various languages and were exclusively aimed at international listeners. However, most of the station’s output was targeted at South Koreans. In 2002, the station was renamed Voice of Korea. Around that time, possibly owing to a temporary rapprochement between North and South Korea, the station curtailed much of its political programming. However, broadcasts featuring political content were resumed in 2016, as relations between the two warring sides began to deteriorate once again.

For much of its existence, the Voice of Korea has also been known to operate as a so-called numbers station. The term denotes shortwave radio stations, usually sponsored by a government entity, that regularly air broadcasts consisting of formatted number sequences. These sequences are widely believed to be encrypted communications addressed to intelligence officers operating abroad. They contain operational instructions and other directives that are typically undecipherable without the use of an encryption protocol. These stations also broadcast certain types of music, which function as codewords and are believed to signal specific directives to spies.

But the Voice of Korea unexpectedly fell silent last week. Its website, which features content in several languages, also appears to have been taken down. The sudden changes occurred days after North Korea’s Supreme Leader, Kim Jong-un, delivered a key address during the year-end plenum of the ruling Workers’ Party of Korea (WPK) in Pyongyang, on December 31. In his speech, which became public on January 6, the North Korean leader declared that the reunification of Korea under communist principles —a longstanding goal of the WPK—had been rendered “impossible” due to widening differences in approach between the two Koreas.

The North Korean strongman also called for “a fundamental change” in the WPK’s policy on inter-Korean affairs. Finally, he discussed a series of steps for the “reorganization of entities” that govern North Korea’s relations with South Korea. Several North Korean government websites focusing on the reunification of Korea, including the Voice of Korea website, have since been taken down. North Korea observers suggest that the daily radio broadcasts of the Voice of Korea appear to be part of the reorganization declared by Kim Jong-UN on December 31.

► Author: Joseph Fitsanakis | Date: 15 January 2024 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , ,

North Korean hackers behind ‘sophisticated’ effort to elicit views of experts

December 13, 2022 by 2 Comments

North KoreaA NOTORIOUS NORTH KOREAN hacker group is believed to be behind a “sophisticated” effort to elicit the views of international experts on issues that are of concern to Pyongyang, according to an investigation by Reuters. The news agency said its reporters had managed to uncover this previously unreported campaign with the help of cybersecurity experts and five individuals who had been targeted by the North Korean hackers.

The North Korean hacker group that is alleged to be behind this elicitation campaign is known among cybersecurity experts as Thallium, or Kimsuky. It has been active since at least 2012 and has orchestrated intensive “spear-phishing” attacks against international targets. Similarly to other hacker groups that have been active in the past decade, Thallium’s operations have centered on tricking its targets to download malware on their personal electronic devices, or to share sensitive information, including passwords.

Lately, however, the group has changed its tactics in striking ways, according to Reuters. Instead of trying to steal secrets, it has been involved in a campaign aimed at eliciting the views of Western experts on North Korean affairs. It has been doing so by directly contacting these experts with requests to review policy papers, or by commissioning opinion pieces on various aspects of North Korean politics, economy and society. The requests are camouflaged to appear as originating from respected think-tanks, universities or consultancy firms.

Since January of this year, when the first experts began to be contacted, “multiple” individuals have fallen victim to this elicitation campaign, according to experts at the Microsoft Threat Intelligence Center (MSTIC). They include policy experts working for Western governments, think-tank and university researchers, as well as human-rights campaigners. They have all fallen victim to “sophisticated” requests that use polished language and appear legitimate, according to Reuters.

In most cases, the elicitation emails promise a payment of $300.00 in return for reviewing a manuscript, authoring a short opinion piece, or recommending another expert who may be able to provide these services. However, none of the individuals who proceeded to provide these services have ever received any funds. Cybersecurity experts, who reviewed the elicitation campaign, told Reuters that the hackers never intended to provide any payments to targets.

► Author: Joseph Fitsanakis | Date: 13 August 2022 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , ,

South Korea busts alleged North Korean spy ring, handler remains at large

April 29, 2022 by Leave a comment

North and South KoreaSOUTH KOREAN AUTHORITIES HAVE busted an alleed spy ring run by a North Korean handler, who remains at large. Two men have been arrested so far in connection with the ring. One of them, identified only as “Lee”, is reportedly the chief executive of a South Korean cryptocurrency exchange. The other man, a Republic of Korea Army officer, is identified as “Captain B.” in court documents.

Lee was arrested on April 2, while Captain B. was arrested on April 15. They are facing charges of violating South Korea’s 1948 National Security Act. Prosecutors alleged that the two men divulged to their North Korean handler the log-in credentials to the online command-and-control portal of the Republic of Korea Armed Forces. The men are accused of having received substantial financial compensation in return for their services.

According to the prosecution, Lee was approached in July 2021 by a North Korean intelligence officer, who recruited him to work for North Korean intelligence. In August of the same year, Lee approached Captain B., and recruited as a subcontractor, with the promise of substantial financial compensation in the form of bitcoin. Captain B. then began giving military secrets to Lee, who passed them on to the North Koreans.

Eventually, Lee’s handler allegedly provided him with a miniature camera hidden inside an electronic watch. Lee gave this spy device to Captain B., along with a hacking device hidden inside a flash drive, which is commonly known as a “poison tap”. This device gave the North Korean handler access to the laptop used by the men to access the South Korean military’s command-and-control portal. The two alleged spies were compensated with nearly $600,000 in bitcoin for their services.

South Korean authorities claim that the North Korean handler of the spy ring, as well as a man who worked as a courier between the handler and the two agents, remain at large. Public court documents do not specify the kind of information that was allegedly accessed by the North Koreans as a result of this breach.

► Author: Ian Allen | Date: 29 April 2022 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , ,

American computer programmer jailed for giving technical know-how to North Korea

April 13, 2022 by Leave a comment

North Korea PyongyangAN AMERICAN COMPUTER PROGRAMMER has been jailed for 63 months for providing “highly technical information” to North Korea, which related to cryptocurrency systems, according to United States officials. The programmer, Virgil Griffith, 39, also known as “Romanpoet”, became widely known in the early 2000s, when he began describing himself as a “disruptive technologist”. He later consulted with the Federal Bureau of Investigation and other law enforcement agencies in the area of the dark web and cryptocurrencies.

In later years, however, Griffith developed what his lawyer described as a “curiosity bordering on obsession” with North Korea. The FBI arrested Griffith in November of 2019, accusing him of deliberately providing the North Korean government with “highly technical information” relating to blockchain and cryptocurrency systems. According to US government prosecutors, Griffith committed a crime when he delivered an invited presentation at an international conference on cryptocurrencies in Pyongyang, North Korea, in April of 2019.

Prior to attending the conference, Griffith had been barred from traveling to North Korea by the United States Department of State. He managed to get there anyway and, according to US prosecutors, “advised more than 100 people” on the use of cryptocurrencies to evade banking regulations and international sanctions. Griffith should have known that many of those he spoke to were employees of the North Korean government, US prosecutors said. They argued that Griffith’s actions amounted to an illegal transfer of highly technical knowledge. By attending the conference, Griffith essentially provided services to a foreign power that is hostile to the United States, prosecutors claimed.

Griffith has been given a 63-month prison sentence, which will be followed by a 3-year supervised release. He has also been fined $100,000. As intelNews has previously reported, a United Nations report warned earlier this year that the North Korean missile program has developed rapidly in recent times, partly due to an influx of stolen cryptocurrency, which has now become “an important revenue source” for Pyongyang.

► Author: Joseph Fitsanakis | Date: 13 April 2022 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , ,

North Korea uses stolen cryptocurrency to fund its missile program, UN report claims

February 7, 2022 by Leave a comment

Kim Jong-un North Korea DPRKTHE NORTH KOREAN MISSILE program has developed rapidly in the past year, partly due to an influx of stolen cryptocurrency, which has now become “an important revenue source” for Pyongyang, according to a United Nations report. The confidential report was produced for the United Nations’ Security Council, by a committee tasked with monitoring the impact of the supranational body’s sanctions on the North Korean economy.

The United Nations imposed sanctions on North Korea in 2006, in response to its announcement that it possessed nuclear weapons. These sanctions have increased over the years, as Pyongyang has continued to advance its nuclear and ballistic missile programs. The sanctions have targeted the communist country’s export industry sectors, including fisheries, textiles, raw materials such as iron, lead and coal, as well as refined energy products.

Now a new report, produced for the United Nations Security Council, suggests that, not only have the sanctions failed to degrade Pyongyang’s nuclear and missile weapons programs, but that the latter actually saw a “marked acceleration” in 2021. The report was delivered last week to the United Nations Security Council by a committee tasked with monitoring the effects of international sanctions on North Korea. According to the Reuters news agency, which accessed the confidential report, it states that North Korea has been able to demonstrate “increased capabilities for rapid deployment, wide mobility (including at sea), and improved resilience of its missile forces”.

Much of this ability comes from funding derived through “cyberattacks, particularly on cryptocurrency assets”, which have now become “an important revenue source” for the North Korean government. These cyberattacks are conducted by North Korean hackers, who regularly target “financial institutions, cryptocurrency firms and exchanges”. According to the report, North Korean hackers were recently able to steal cryptocurrency valued at over $50 million, by attacking just three cryptocurrency exchanges in a period of just 18 months.

The United Nations report comes in the heels of another report, published last month by cybersecurity firm Chainalysis, which alleged that Pyongyang was able to acquire digital assets worth nearly $400 million in 2021 alone. That made 2021 one of the most successful years for North Korean government-sponsored hackers, according to the report. To this one must add cyberattacks that do not target cryptocurrency, which also generate foreign cash supplies for the North Korean government. These generate several hundred million dollars each year, according to research.

► Author: Joseph Fitsanakis | Date: 07 February 2022 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , ,

Senior American, Japanese and S. Korean spy officials to meet behind closed doors

October 18, 2021 by Leave a comment

Avril HainesTHE INTELLIGENCE CHIEFS OF the United States, Japan and South Korea are to meet behind closed doors this week. The meeting will take place nearly two years after a major diplomatic spat between Japan and South Korea threatened to significantly harm intelligence cooperation between them. In November of 2019, the South Korean government threatened to terminate the General Security of Military Information Agreement (GSOMIA). The agreement was initiated in 2016 under American tutelage, with the aim of facilitating the sharing of intelligence between South Korea and Japan about North Korea’s missile and nuclear programs.

As intelNews explained at the time, the agreement fell victim to an escalating tit-for-tat row between the two Asian countries, which was rooted in the use of forced Korean labor by Japanese troops during World War II. The South Korean government demanded financial compensation for the use of slave labor, including sex slaves, by Japanese occupation troops during the annexation of Korea by Japan, which lasted from 1910 until 1945.

Tokyo responded to a mass boycott of Japanese goods in South Korea by limiting the export of electronics for use in South Korea’s ship-building industry. It also removed South Korea from the list of countries that can fast-track their exports to Japan. South Korea responded by threatening to not renew GSOMIA prior to it lapsing. With hours to go before GSOMIA’s expiration deadline, Seoul announced it would prolong the treaty. But the dispute continues to stymie intelligence cooperation between the two Asian nations.

On Saturday, the South Korean Yonhap News Agency cited “a government source” in reporting that the intelligence chiefs of the United States and Japan would travel to Seoul next week, in order to hold a series of meetings with their South Korean counterpart. Thus, United States Director of National Intelligence, Avril Haines, and Japan’s Director of Cabinet Intelligence, Hiroaki Takizawa, will meet with Park Jie-won, who heads South Korea’s National Intelligence Service.

The three officials will meet behind closed doors to discuss “strengthening their trilateral intelligence cooperation”, according to the report. There is renewed hope in Seoul and Tokyo that relations between the two nations can be mended, following the election of a new government in Japan earlier this month, under Prime Minister Fumio Kishida. The officials are also expected to discuss efforts to re-initiate negotiations with North Korea on a number of issues. Last month, South Korean President Moon Jae-in offered to begin negotiations with North Korea aimed at drafting a formal declaration to officially end the Korean War of 1950-1953.

► Author: Joseph Fitsanakis | Date: 18 October 2021 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , , ,

In historic first, alleged North Korean spy to face trial in the United States

March 29, 2021 by 1 Comment

DPRK North Korean embassy in Malaysia

FOR THE FIRST TIME in history, an alleged intelligence officer of North Korea is going to be tried in a United States court, according to American government officials. In a surprise move last week, Malaysia extradited to the US an export-finance trader named Mun Chol-myong. Aged 55, Mun is a North Korean citizen based in Singapore, where until 2019 he worked for a company called Sinsar Trading Pte. Ltd. The Malaysians arrested him in May 2019 and charged him with using his position to defraud a number of international banks and launder money though the US financial system.

Responding to a US request to have Mun tried in a US court, Malaysia announced his extradition last week, angering Pyongyang. Shortly following Mun’s extradition to the US, North Korea shut down its embassy in Kuala Lumpur, one of only 46 embassies maintained by Pyongyang across the world. Then last Wednesday North Korea fired two ballistic missiles in violation of United Nations sanctions designed to restrict the country’s nuclear weapons program. North Korea’s fury at Mun’s extradition can perhaps be explained by information contained in the newly unsealed indictment [pdf], which dates to 2018. The indictment accuses Mun and a number of other unnamed suspects of being North Korean “intelligence operatives”.

Specifically, the indictment accuses Mun of being an undercover employee of the Reconnaissance General Bureau (RGB), North Korea’s primary foreign-intelligence agency. The RGB operates under the supervision of the General Staff Department of the Korean People’s Army and the Central Committee of the ruling Workers’ Party of Korea. According to the indictment, Mun utilized shell companies set up by Pyongyang in order to hide his connections with the RGB. His primary mission was allegedly to gain access to international banking institutions and wire services, with the aim of laundering illicit North Korean cash and breaking sanctions imposed on Pyongyang by the United Nations and the United States. The indictment accuses Mun of having personally participated in the laundering of $1.5 million in funds in recent years.

In a statement released last week, John Demers, assistant attorney general for the National Security Division of the US Department of Justice, described Mun as “the first North Korean intelligence operative —and the second ever foreign intelligence operative— to have been extradited to the United States”. Meanwhile, the administration of US President Joe Biden said last week it was still reviewing “in depth” the state of US-North Korean relations following the administration of Biden’s predecessor, Donald Trump.

► Author: Joseph Fitsanakis | Date: 29 March 2021 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , ,

North Korean diplomat, related to top regime official, defected to South, say sources

January 25, 2021 by Leave a comment

Kuwait CityA NORTH KOREAN ACTING ambassador, who is believed to be the son of one of the most senior officials of the ruling Workers’ Party of Korea (WPK), reportedly defected with his family to South Korea, according to sources. Two South Korean news outlets, the Yonhap News Agency and the Maeil Business Newspaper, reported the alleged defection on Monday. They both cited sources in the South Korean government.

The alleged defector is Ryu Hyun-Woo, who was serving as acting charge d’affaires at the North Korean embassy in Kuwait City, Kuwait. He assumed his post in October 2017, when the Kuwaiti government expelled the North Korean ambassador from the country. The expulsion was ordered in response to a nuclear test conducted by Pyongyang in September of that year, which was in violation of a United Nations Security Council resolution barring the communist state from carrying out nuclear activities.

The government in Pyongyang attributes major significance to its embassy in Kuwait City, since it constitutes its sole diplomatic presence in the Gulf region. Personnel who serve at the embassy are carefully vetted and come from some the most loyal families in the inner circle of the WPK. However, it appears that Ryu, who headed the embassy after October 2017, defected with his wife and children in September 2019. The family reportedly flew to South Korea, where they requested asylum upon arrival. According to the Maeil Business Newspaper, Ryu said he defected in order “to provide his children with a better future”.

According to the South Korean reports, Ryu is the son-in-law of Jon Il-Chun, who formerly directed the Central Committee Bureau 39 —or Office 39— of the WPK. This is the agency tasked by the North Korean regime with securing highly-sought-after hard foreign currency for use by the ruling family and their closest aides. It has been described as the operational nerve center of the North Korean government. If the reports of Ryu’s defection are correct, they would mark a major incident of disloyalty to the regime by a member of the innermost circle of the ruling elite.

Last October it was reported that Jo Song-gil, North Korea’s ambassador to Italy, who disappeared without trace in 2018, was believed to have resettled in South Korea. If true, that would make him the most senior official to defect from North Korea in over 20 years, and it would make Ryu the second most senior official to defect during that time.

► Author: Joseph Fitsanakis | Date: 25 January 2021 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , ,

North Korean leader Kim Jong-un’s half-nephew is in CIA custody, report claims

November 18, 2020 by Leave a comment

Kim Jong-nam murderTHE HALF-NEPHEW OF North Korean leader Kim Jong-un, who disappeared in 2017 and has not been seen since, is in the custody of the United States Central Intelligence Agency (CIA), according to a new report. The missing man’s name is Kim Han-sol. He is the son of the late Kim Jong-nam (pictured), the eldest son of Kim Jong-il and grandson of Kim Il-Sung, who founded the Democratic People’s Republic of Korea in 1948. A critic of North Korea’s rulers, Kim lived in self-exile in the Chinese territory of Macau, and split his time between China, Singapore and Malaysia.

In February of 2017, Kim Jong-nam was assassinated in audacious attack at a busy airport in Malaysia by two women who used a poisonous substance to murder him in broad daylight. Suspicions fell immediately on the North Korean government, and many assumed that his two children and wife would be next. The family, who lived in Macau at the time, frantically made plans to leave for the West and seek political asylum there. To make it more difficult for potential assassins to find them, Kim Jong-nam’s family members made the decision to separate and take different routes to Europe.

As intelNews has reported before, Kim Jong-nam’s eldest son, Kim Han-sol, sought and received protection from an obscure North Korean dissident group, which calls itself Cheollima Civil Defense and is also known as Free Joseon. Cheollima Civil Defense, whose members support on principle anyone who challenges the regime in Pyongyang, helped Kim’s family relocate to the West, allegedly with assistance from China, the United States and Holland.

However, unlike Kim Jong-nam’s wife and youngest son, Kim Han-sol never made it to Europe, and his whereabouts remain unknown. Now a new report in The New Yorker magazine claims that Kim Han-sol flew from Macau to Taiwan, escorted by Cheollima Civil Defense members. From there, he was scheduled to take a flight to Amsterdam’s Schiphol Airport, where Cheollima Civil Defense members and Dutch activists were waiting for him. But he never emerged from the arrivals gate. According to The New Yorker, that was because a team of CIA officers intercepted Kim Han-sol in Taiwan and took him under US custody.

The magazine claims Kim Han-sol remains under US custody to this day, but does not clarify whether that is a voluntary arrangement on the part of the North Korean exile. It is also not clear if Kim Han-sol’s mother and brother are with him, or if they are aware of his whereabouts. It is believed that Kim Jong-nam’s income came from a North Korean government slush fund that he was managing in Macau, and that much of the fund came from illicit sources. It is possible that Kim Han-sol was also involved in running that fund, which would explain the CIA’s interest in him.

► Author: Joseph Fitsanakis | Date: 18 November 2020 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , ,

North Korea’s missing ambassador may be most senior defector since 1997

October 8, 2020 by Leave a comment

Jo Song-gil

North Korea’s ambassador to Italy, who disappeared without trace in 2018, is believed to have resettled in South Korea. If true, this would make him the most senior official to defect from North Korea in over 20 years. Jo Song-gil (pictured), 48, a career diplomat who is fluent in Italian, French and English, presented his diplomatic credentials to the Italian government in May of 2015. In October 2017 he became his country’s acting ambassador, after Italian authorities expelled Ambassador Mun Jong-nam from the country.

Jo comes from a high-ranking family of North Korean officials with a long history in the ruling Workers Party of Korea. His father is a retired diplomat and his wife’s father, Lee Do-seop, spent many years as Pyongyang’s envoy in Hong Kong and Thailand. It is believed that Jo had been permitted to take his wife and children with him to Rome, a privilege that is bestowed only to the most loyal of North Korean government official. But in November of 2018, Jo suddenly vanished along with his wife and children. The disappearance occurred a month before Jo was to be replaced as acting ambassador to Italy. At the time of Jo’s disappearance, South Korean media reported that the diplomat and his family “were in a safe place” under the protection of the Italian government, while they negotiated their defection. However, this was never confirmed.

On Tuesday of this week, a social media post by a South Korean parliamentarian claimed that Jo and his wife were living in South Korea under the protection of the government, but provided no evidence of this claim. Yesterday, this information appeared to be confirmed by another South Korean parliamentarian, Jeon Hae-cheol, who chairs the Intelligence Committee of the Korean National Assembly (South Korea’s parliament). Jeon said the North Korean diplomat had been living in South Korea since the summer of 2019. He added that Jo had arrived in South Korea after having “repeatedly expressed his wish to come to South Korea”.

This information has not been officially verified by the South Korean government. Additionally, the South Korean National Intelligence Service has not issued a statement on the matter. If this information is confirmed, it would make Jo the most senior North Korean official to have defected since 1997. That year saw the sensational defection of Hwang Jang-yop, Pyongyang’s primary theorist and the ideological architect of juche, the philosophy of self-reliance, which is North Korea’s officially sanctioned state dogma. Until his death from heart failure in April 2010, Hwang had been living in the South with around-the-clock security protection.

Some reports have suggested that Jo’s teenage daughter refused to follow her parents to South Korea and that she was “repatriated” to North Korea in February of 2019, at her own request. Her whereabouts remain unknown.

► Author: Joseph Fitsanakis | Date: 08 October 2020 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , ,

North Korea targeted UN Security Council officials with spear-phishing campaign

August 5, 2020 by Leave a comment

United Nations headquartersComputer hackers working for North Korea launched cyberattacks against carefully selected officials of national delegations belonging to the United Nations Security Council, according to a soon-to-be released report. The report is expected to be submitted early next month to the UN Security Council Sanctions Committee on North Korea.

Known previously as the UN Security Council Committee Established Pursuant to Resolution 1718, the committee was created in 2006 as part of the UN Security Council’s resolution 1718. The resolution was implemented in response to the first nuclear test conducted by North Korea on October 9 of that year, which confirmed beyond doubt the existence of Pyongyang’s nuclear weapons program. The committee’s mission is to gather information about North Korea’s nuclear activities, examine and evaluate the impact of international sanctions, and issue periodic recommendations to the UN National Security Council.

A draft version of the report was leaked to the media earlier this week. It states that a North Korean cyberattack targeted at least 11 officials belonging to six different national delegations that are members of the UN National Security Council. According to the draft report, the 11 officials were targeted earlier this year via a so-called “spear-phishing” campaign. The term refers to cyber-espionage operations in which hackers carefully select specific staff members of larger organizations for penetration. The targeted officials were reportedly approached using Gmail and WhatsApp, by a group of hackers who used fake identities.

The report also details efforts by the North Korean regime to acquire foreign hard currency through illicit hacking operations, as well as by illicitly acquiring virtual assets, such as cryptocurrencies. There is increasing speculation among North Korea observers about Pyongyang’s involvement in the cryptocurrency industry —though how exactly the government manages to cash out its alleged cryptocurrency assets remains a mystery.

► Author: Joseph Fitsanakis | Date: 05 August 2020 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , ,

South Korea, China, urge caution over rumors of North Korean leader’s death

April 21, 2020 by 1 Comment

Korean DMZOfficials in South Korea and China have cast doubt on rumors circulating in recent days that North Korean Supreme Leader Kim Jong-un may be dead or close to dying. The rumors about Kim’s demise began to circulate on April 15, when the North Korean leader failed to participate at an official ceremony held to mark the birthday of his grandfather. Known as the Day of the Sun —a public holiday in North Korea— the annual event commemorates the birth of the country’s founder, Kim il-Sung.

Kim’s absence sparked intense discussion in South Korea. On the same day, April 15, Daily NK and NK News, two South Korean websites that are critical of the North Korean government, claimed that Kim had been taken to hospital on April 11 and had not been seen since. The website, which regularly carries articles by North Korean defectors to the South, claimed that the 36-year-old supreme leader had undergone an emergency procedure to stabilize his cardiovascular system, and was recovering from the surgery.

On Monday the American news network CNN quoted an unnamed US official as saying that the sources of the reports about Kim’s health were “credible”. The official added that Washington was closely assessing reports that Kim’s life was “in grave danger”. But on Tuesday officials in South Korea said the reports about Kim’s imminent demise could not be corroborated. A spokesman at the Office of the President told reporters in Seoul that Kim was probably traveling in the countryside with an entourage of senior North Korean officials. The spokesman added that South Korean intelligence services had detected “no unusual signs” in the North Korean capital, Pyongyang.

Also on Tuesday, a spokesman with the Department of International Liaisons of the ruling Communist Party of China, said “there was no reason to believe Kim was critically ill” or dead. There was speculation on Monday that Kim may be alive but staying indoors to avoid getting infected by the novel coronavirus. The United States government has not commented officially on the rumors about the state of Kim’s health.

► Author: Ian Allen | Date: 21 April 2020 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , ,

Militaries around the world scramble to contain impact of COVID-19

March 11, 2020 by 1 Comment

COVID-19 ChinaMilitary forces around the world are scrambling to contain the impact of COVID-19 on military readiness, as the virus continues to infect troops and commanders at an alarming rate. On Tuesday, the Polish government announced that General Jaroslaw Mika, who serves as general commander of Branches of the Armed Forces, had tested positive for the coronavirus. General Mika is believed to have contracted the virus during a military conference that took place in the German city of Wiesbaden, where North Atlantic Treaty Organization commanders gathered to plan an American-led military exercise.

Also on Tuesday, the United States Department of Defense said that the commander of the US Army in Europe, Lieutenant General Christopher Cavoli, participated at the Wiesbaden conference, along with several other US Army staff members. They are currently being tested for exposure to COVID-19. Meanwhile the Reuters news agency reported that the US Pentagon acknowledged that “the US military’s official tally of servicemembers and related personnel who have been infected by the coronavirus likely undercounts the actual total”. Sources told the news agency that the low age and good health of American troops was “a mixed blessing of sorts”, since it allows US servicemembers to survive the virus but at the same time reduces their symptoms that would normally trigger testing for COVID-19.

The government of Taiwan said on Tuesday that over 400 members of its armed forces had entered self-imposed quarantine in order to prevent a possible COVID-19 outbreak among military personnel. This brings the total number of Taiwanese servicemembers who are currently in quarantine to over 2,000, which includes two generals. The country’s Minister of Defense, Yen De-fa, insisted on Tuesday that the virus had not impacted Taiwan’s military readiness.

Chinese officials have not provided information about the effect of the coronavirus on the country’s military. The Chinese-language website of The Epoch Times said last week that, according to unnamed insiders, the Chinese People’s Liberation Army had “forcibly isolated” tens of thousands of servicemembers this month. There are no reports of specific numbers in the Chinese media or non-Chinese news outlets.

Finally, according to Daily NK, a South Korean website that specializes on news from North Korea, approximately 180 North Korean soldiers have died as a result of contracting COVID-19 in the past month. The website cited “a source inside the North Korean military”, who said that Pyongyang had forcibly quarantined at around 3,700 soldiers of all ranks to prevent the spread of COVID-19 in the country’s military.

► Author: Joseph Fitsanakis | Date: 10 March 2020 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , , ,

Czech intelligence foiled North Korean plan to smuggle arms through Africa

January 31, 2020 by Leave a comment

Czech Security Information ServiceThe Czech intelligence services foiled a secret plan by North Korea to smuggle weapons parts and surveillance drones, leading to the expulsion of a North Korean diplomat from the country, according to a report. The report, published this week by the Czech daily Deník N, claims that the alleged plot was foiled by the Czech Security Information Service, known as BIS.

According to Deník N, the alleged plot took place in 2012 and 2013. It was initiated by a North Korean diplomat who was serving at the DPRK’s embassy in Berlin as an economic attaché. However, claims Deník N, the diplomat was in fact operating on behalf of the North Korean intelligence services. The unnamed diplomat allegedly traveled to Prague and contacted a local businessman, seeking to purchase spare parts for use in Soviet-built T-54 and T-55 tanks, as well as spare parts for armored vehicles and jet airplanes. The diplomat also sought to purchase surveillance drones, according to the newspaper.

The buyers reportedly planned to smuggle the acquired weapons parts and drones to North Korea through ports in Africa and China, said Deník N. Such an act would have violated the international embargo that has been in place against the DPRK since 2006. However, the plot was foiled by the BIS, which informed the Czech Ministry of Foreign Affairs. The Czech government eventually detained the diplomat and expelled him from the country, said Deník N.

Following the newspaper article, BIS spokesperson Ladislav Šticha said that he “could not comment on the details” of the case, but could confirm that “in the past BIS has indeed managed to prevent trade in weapons from the Czech Republic to the DPRK”. Hours later, the BIS posted on its Twitter account that it could not comment “on the details of this case”, but added that “its outcome was very successful”.

IntelNews regulars will remember a similar report in the German media in 2018, according to which North Korea used its embassy in Berlin to acquire technologies that were almost certainly used to advance its missile and nuclear weapons programs.

► Author: Joseph Fitsanakis | Date: 31 January 2020 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , ,

← Older posts