North Korean state cyber operations

North Korea has faced both domestic internet disruptions and international scrutiny regarding its cyber capabilities. In October 2026, over 40 state-managed websites, including the Ministry of Foreign Affairs and the KCNA news agency, experienced outages lasting approximately 32 hours. Analysis by the firm Kentik suggested these disruptions were caused by a Distributed Denial-of-Service (DDoS) attack involving traffic from Vietnam, the Philippines, and Venezuela, though some experts noted that unstable power supplies might also be a factor.

Parallel to these disruptions, South Korean intelligence reports indicate that North Korea has expanded its specialized hacking workforce to approximately 8,400 personnel. Under the direction of Kim Jong Un, these operatives reportedly target banks, technology firms, and cryptocurrency platforms to conduct espionage and bypass international sanctions. One such operation, linked by U.S. authorities to the group TraderTraitor, allegedly involved the theft of 6.3 billion dollars in digital assets from the exchange Binance.

New reports suggest the existence of a systematic state-sponsored program where the government selects highly intelligent middle school students, aged 11 to 12, for intensive computer engineering training lasting over a decade. These operatives are reportedly trained in cryptocurrency protocols and the reverse engineering of foreign hardware. Successful participants allegedly receive privileges such as luxury apartments in Pyongyang and the ability to travel to allied nations. While North Korea has dismissed these allegations as “political provocations,” former trainers have described the program as a “secret weapon” intended to provide the regime with strategic and financial capabilities.