The Cyber Defense eMagazine November Edition for 2023

Stalin’s postwar goals were security for himself, his regime, his country, and his ideology, in precisely
that order. He sought to make sure that no internal challenges could ever again endanger his personal
rule, and that no external threats would ever again place his country at risk.
This can also be said of the Putin and Kim Jong-un duo, who are now finding common ground in the new
Cold War as the current state of international relations is often characterized. So, while both autocratic
leaders aimed to project solidarity against a global order dominated by the West in their statements, their
strategic convergence actually stems from a more transactional logic spurred on by difficult
circumstances for both leaders.
The Cyber Angle: Potential for Russia-DPRK cooperation in cyberspace
Russia's immediate interest in cultivating its relationship with North Korea is the prospect of Pyongyang
supplying Russia's army with artillery ammunition, as expenditures have far exceeded Russian
production capacity. There are, however, other potential areas of cooperation, notably in cyberspace.
Prior to 2017, virtually all of North Korean internet traffic had passed through China and specifically
through a single meta-network based in Shenyang, the largest Chinese city close to North Korean
borders, where there strong North Korean cyber community is based due to insufficient infrastructure in
the home country. However as of 2017, North Korea is also linked to Russia, presumably via cable
running through the Friendship Bridge over the Tumen River that connects Khasan in Russia with
Tumangang in North Korea and constitutes the only connection between the two countries. However,
that is not the only instance of technological facilitation in the relationship. Given the general low level of
technical expertise, general backwardness and very low internet connectivity in North Korea, the North
Korean attacks are widespread and increasingly sophisticated, which leaves the experts to believe China
and lately especially Russia were technical facilitators for Pyongyang, which would constitute a historical
precedent for Russian state hackers sharing their know-how with their North Korean counterparts.
Potential cooperation between Russia and North Korea in cyberspace wouldn't necessarily require much
coordination. Most of North Korea's offensive cyber operations are already directed against countries
whose relations with Russia are at least cool, if not downright adversarial. In 2023 alone, North Korean
APTs have compromised defense companies
in the Czech Republic, Finland, Italy, Norway and Poland – all countries with an adversarial stance to
Russian aggression in Europe. At the same time, as outlined above, the relations between the two
countries still remain largely transactional and the Russian government and defense industries remain
targets for North Korean APTs as well. This spring alone, DPRK’s threat actor Ruby Sleet compromised
an aerospace research institute in Russia, while another APT compromised a device belonging to a
university in Russia with yet another group sent phishing emails to accounts belonging to Russian
diplomatic government entities, only to be followed by targeting of a Russian defense industrial base
organization specializing in missiles and military spacecraft by two important North Korean hacking
groups ScarCruft and the notorious Lazarus.
Cyber Defense eMagazine – November 2023 Edition 148
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.