North Korea’s Cyberwarfare Capabilities and Doctrine: Espionage, Revenue and Asymmetric Power

Begin with Bybit: the theft that exposes the whole system

Evidence cutoff: 18 September 2026. On 21 February 2025, a routine-looking cryptocurrency transfer became the largest publicly recorded digital-asset theft. Approximately $1.5 billion left the Bybit exchange. Five days later, the FBI Bybit attribution assigned responsibility to North Korea and used the name TraderTraitor. The bureau warned that the assets were already being converted and dispersed across thousands of addresses on multiple blockchains.

The incident is a better entrance to North Korean cyber power than an image of uniformed hackers in Pyongyang. Public investigations indicate that the operation reached a trusted developer environment in the software and custody chain used to authorize a legitimate transfer. The visible blockchain movement came last. Before it were target study, human deception, access to a developer, manipulation of a trusted interface or code path, knowledge of multisignature processes, and preparation for laundering at extraordinary scale. Google later used the case in its Google 3CX supply-chain assessment to illustrate how compromise of developer tooling and dependencies can create a precise downstream effect.

That distinction matters. A blockchain can preserve a public trail after theft, but it cannot prevent a trusted person, workstation, supplier, or signing workflow from being deceived. “Cold wallet” does not mean that every human and software dependency in the authorization chain is cold. The operational target was trust.

The state-finance connection is not an inference from one vendor. The eleven-country Multilateral Sanctions Monitoring Team’s 2025 MSMT cyber report summary assessed that the DPRK stole about $2.84 billion in virtual assets between January 2024 and September 2025, including roughly $1.65 billion in the first nine months of 2025. It documented overseas brokers and laundering activity connected with China, Russia, Hong Kong, Cambodia, and other jurisdictions. Chainalysis later estimated in its 2026 Chainalysis theft assessment that DPRK-linked actors stole $2.02 billion during all of 2025. The figures differ because the periods and methodologies differ; both show an industrial program rather than occasional crime.

Why put a financial theft in a cyberwarfare page? Because a practical definition of cyberwarfare should not label every intrusion during geopolitical rivalry an act of war. Bybit was cyber-enabled theft. Yet the operators, state direction, laundering system, sanctions environment, and assessed destination of proceeds make it part of North Korea’s national-power system. Revenue supports government priorities, including prohibited nuclear and ballistic-missile programs. The operation is not “war” because of its dollar value; it is strategically relevant because the state has fused crime, intelligence, procurement, and security policy.

That fusion is North Korea’s defining feature. The same ecosystem can steal money, collect diplomatic plans, obtain missile or aerospace knowledge, punish speech, compromise software, extort an employer, or prepare access useful in crisis. The rest of this journey explains how those missions developed—and why defenders fail when they look for only a conventional military hacker.

Doctrine without a public manual: an asymmetric “all-purpose” instrument

North Korea does not publish a transparent cyber doctrine, force structure, budget, or chain of command that outside analysts can audit. Quotations attributed to Kim Jong Un describing cyberwarfare as an “all-purpose sword” circulate widely, but many repeat secondary accounts without an accessible primary text. The professional approach is to reconstruct doctrine from sustained behavior and official evidence, then label the reconstruction as analysis.

Six principles recur.

1. Regime security comes first. Operations collect diplomatic intentions, sanctions policy, military plans, elite opinion, defectors’ networks, and information about the Korean Peninsula. The target is often a person with access to decisions rather than a fortified government server.
2. Cyber compensates for material constraints. North Korea cannot match the United States, South Korea, or Japan across the full conventional, economic, and technological spectrum. Remote access offers reach, speed, deniability, and favorable cost without moving a ship or aircraft.
3. Intelligence and military modernization reinforce each other. Theft of aerospace, defense, maritime, uranium-processing, nuclear, and engineering information can shorten research cycles, support procurement, or reveal adversary capability and intent.
4. Operations must help finance the state. Bank heists, cryptocurrency theft, ransomware, and IT-worker salaries generate foreign currency under sanctions. This is not a side business tolerated by the state; official investigations describe government-linked organizations, quotas, managers, and remittance systems.
5. Peacetime access is strategic reserve. Espionage access can provide warning today and options for disruption in crisis. Not every foothold is immediately monetized or destroyed. Good cyber access stewardship preserves the position that best serves policy.
6. Ambiguity is useful. Front companies, foreign infrastructure, stolen identities, facilitators, criminal services, and overlapping cluster names slow political and legal response. They do not make attribution impossible; they increase the work required.

This doctrine is broader than battlefield cyber operations. It joins national intelligence, coercive signaling, economic survival, sanctions evasion, procurement, and preparation for conflict. A stolen wallet credential and a stolen missile drawing have different immediate purposes but may support the same strategic program.

It is also adaptive. Early public cases emphasized denial of service and destructive malware against South Korea. Sony demonstrated punishment and censorship through theft, leaks, threats, and wiping. Bangladesh Bank showed global financial reach. WannaCry showed how a revenue-seeking or experimental capability could escape into civilian systems at enormous scale. Cryptocurrency removed some of the friction of stealing through banks. Remote work then placed North Korean personnel behind trusted corporate accounts. Recruitment-themed intrusions turned the technology labor market itself into an access channel.

The relationship with Russia adds a new strategic context. North Korean military support to Russia’s war against Ukraine, Russian diplomatic protection, and deeper economic ties may provide money, operational learning, and space for overseas activity. Public evidence does not establish a wholesale transfer of Russian cyber capabilities to North Korea. Analysts should monitor shared infrastructure, targeting convergence, personnel movement, and procurement rather than assume integration. The companion assessment of Russia’s cyberwarfare capabilities shows why parallel interests are not automatically shared command.

Inside the ecosystem: RGB, mission clusters, workers, and the alias trap

The Reconnaissance General Bureau (RGB) is the most important public anchor. It is North Korea’s principal foreign-intelligence service and a military intelligence organization. U.S., South Korean, Japanese, British, and allied authorities have repeatedly associated RGB elements with espionage, destructive operations, and financial theft. The 2021 RGB hacker indictment alleged that three members of RGB units participated in a single conspiracy spanning destructive attacks, bank fraud, cryptocurrency schemes, and theft. An indictment states allegations, not a conviction or a complete organization chart, but it connects named people, state employment, infrastructure, communications, and transactions in a way vendor labels alone cannot.

Lazarus Group is best treated as an umbrella. It can refer broadly to DPRK-linked activity or more narrowly to a cluster, depending on the source. APT38 and BlueNoroff commonly describe financially focused operations. Andariel is associated with RGB-sponsored espionage, defense-industry collection, and revenue activity including ransomware. The multinational 2024 Andariel joint advisory described targeting of defense, aerospace, nuclear, and engineering organizations and attributed the activity to RGB’s 3rd Bureau. A related 2024 health-sector ransomware case alleged that ransomware proceeds from U.S. health providers helped fund intrusions into government and technology targets. That is a direct illustration of revenue financing espionage.

Kimsuky—also called APT43, Emerald Sleet, Velvet Chollima, and other names—is primarily a strategic intelligence collector. The U.S. Kimsuky designation identifies it as subordinate to the RGB and describes spear-phishing against government, research, think-tank, academic, and media personnel across Europe, Japan, Russia, South Korea, and the United States. Its collection on foreign policy, sanctions, nuclear issues, and negotiations helps leaders understand adversary intentions. Impersonated experts and reporters are not incidental targets; their inboxes contain the policy process before it becomes public.

Other labels identify clusters focused on cryptocurrency, software, and employment. Microsoft’s Citrine Sleet overlaps with labels such as AppleJeus and Labyrinth Chollima; its Microsoft Citrine Sleet research documented exploitation against cryptocurrency targets and linked the activity to RGB Bureau 121. Jasper Sleet represents fraudulent remote-worker activity in Microsoft’s taxonomy. WaterPlum, commonly called Contagious Interview, describes recruitment-themed compromise exposed in a four-country advisory on the date of this page’s evidence cutoff.

The 2026 WaterPlum joint advisory is especially important because Japan’s NPA and the FBI assess both WaterPlum actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department, subordinate to the Workers’ Party’s Central Committee. That is a different public organizational anchor from the RGB. The advisory also links infrastructure used for malicious recruitment and IT-worker applications. North Korea’s cyber ecosystem is therefore not adequately described as “the RGB does everything.” Party, military, technical, commercial-looking, overseas, and facilitation structures can serve related state goals.

Attribution should proceed in layers: Was North Korea involved? Which activity cluster best fits? What organization is publicly associated with it? Was this state tasking, revenue activity under standing orders, or an operation whose exact authority is unknown? Which effect is verified? The guide to cyber attribution helps prevent a malware resemblance from becoming an unjustified claim about a bureau or leader.

Alias discipline is operationally useful. Defenders do not need to solve every naming dispute before acting, but they do need to know whether the observed campaign targets diplomats with document lures, developers through coding tests, cryptocurrency custody, exposed infrastructure, or a defense supplier. Mission and behavior determine the control; the actor name organizes evidence.

Sony, Bangladesh Bank, and WannaCry: three operations, three kinds of power

North Korea’s modern reputation was built through cases that look unrelated until their strategic logic is compared.

Sony Pictures, 2014: punishment and censorship. Attackers stole internal mail, personnel data, films, and business records, destroyed systems, released material, and threatened theaters around the planned release of The Interview, a comedy depicting Kim Jong Un’s assassination. The FBI Sony investigation attributed the operation to the North Korean government, citing technical links to malware previously associated with attacks on South Korea, infrastructure overlap, and other intelligence. Sony took its network offline and the initial theatrical release was disrupted.

Sony was not just a wiper incident. It combined espionage, doxing, destruction, coercive threats, and information operations to influence a private company’s speech. The stolen emails multiplied pressure after the technical outage. This is cyber-enabled influence operations in its coercive form: the intrusion supplied authentic material, the releases shaped attention, and threats changed distribution decisions. The political effect came from the combined campaign, not the malware alone.

Bangladesh Bank, 2016: access converted into cash. Operators compromised the central bank’s environment and sent fraudulent SWIFT payment instructions through its account at the Federal Reserve Bank of New York. Requests totaling almost $1 billion were attempted; most were blocked, but $81 million reached accounts in the Philippines and moved through casinos and intermediaries. The operation required patient access, knowledge of financial processes, timing around weekends and holidays, manipulation of local evidence, and an international cash-out network. The 2021 RGB hacker indictment placed Bangladesh in a wider series of attempted bank thefts from 2015 through 2019.

The lesson was larger than SWIFT security. A highly protected messaging network could still carry fraudulent instructions from a compromised participant. Security depends on the whole business process: endpoint integrity, privileged access, payment verification, printer and log anomalies, correspondent-bank controls, beneficiary screening, time-zone coverage, and the speed of international recovery.

WannaCry, 2017: indiscriminate civilian spillover. The ransomware worm exploited vulnerable Windows systems and spread across organizations in roughly 150 countries. The UK WannaCry attribution assessed that Lazarus was responsible. Forty-eight NHS trusts were affected; appointments and services were disrupted even though hospitals were not a plausible military objective. The operation produced little ransom compared with the harm it caused, and a researcher’s registration of a kill-switch domain sharply constrained its spread.

These cases reveal three different forms of power: coerce a decision, steal through trusted financial rails, and impose disruption at global scale. They also expose limits. Sony provoked international attribution and sanctions. Bangladesh lost much less than the attackers attempted to steal and exposed the laundering network. WannaCry was noisy, uncontrolled, and inefficient. Capability is not the same as strategic success.

Civilian systems bear the consequences when malware propagates beyond its intended population or when revenue operations target health care. Assessment must include civilian harm and reverberating effects: cancelled care, lost wages, identity exposure, inaccessible services, recovery cost, and fear. “No one was physically struck by code” is not an adequate harm analysis.

The revenue machine: from bank messages to wallets, bridges, brokers, and procurement

Cryptocurrency did not create North Korea’s financial mission; it reduced several obstacles. A successful bank theft must pass through regulated institutions, beneficiary accounts, correspondent relationships, and cash-out networks that can freeze or recall funds. Digital assets can move continuously across borders, protocols, and asset types. Public ledgers expose movement, but attribution, freezing, recovery, and conversion still require rapid coordination across private companies and jurisdictions.

The growth was visible before Bybit. The UN Panel’s 2024 final-report overview said the Panel was investigating 17 reported DPRK-attributed cryptocurrency heists in 2023, valued above $750 million, and 58 suspected attacks between 2017 and 2023, valued at about $3 billion. “Investigating” and “suspected” are important qualifiers: the figures are a case pipeline, not a judicial finding that every event had been conclusively attributed.

The portfolio expanded from exchanges to bridges, decentralized-finance services, market makers, venture-capital contacts, wallet providers, individual asset holders, and the people who write or deploy code. The FBI attributed the 2022 Ronin Network theft of about $620 million to Lazarus and APT38 in its FBI Ronin attribution. Japanese and U.S. authorities attributed the May 2024 theft of approximately $308 million from DMM Bitcoin to TraderTraitor in the Japan DMM Bitcoin attribution. A 2025 trilateral cryptocurrency statement also identified attributed thefts from Upbit and Rain, while the United States and South Korea attributed major WazirX and Radiant Capital incidents.

The common opening is frequently human. An operator builds a relationship with an employee, investor, recruiter, or developer; a meeting, maintenance request, job offer, or coding task creates a reason to open a project or run software; credentials, session tokens, source code, cloud access, or wallet material are collected; the team maps authorization; and the theft is staged. Exploits and bespoke malware matter, but trust and workflow knowledge turn access into money.

After theft, the problem becomes treasury operations. Assets may be split, swapped, bridged across chains, passed through mixers or decentralized services, held until attention falls, transferred to brokers, or exchanged for fiat and goods. The MSMT documented foreign facilitators and the use of stolen assets and stablecoins in procurement and trade. It also cautioned that not every observed address or transfer has the same level of confidence. Analysts should preserve transaction time, asset type, chain, service, cluster rationale, attribution source, and valuation method. The dollar value at theft, seizure, or publication can differ substantially.

This is the strategic chain:

access → theft → obfuscation → conversion → remittance or procurement → state priority.

It is not automatic. Exchanges freeze assets, analytics companies cluster wallets, law enforcement seizes domains and funds, smart-contract issuers can sometimes block tokens, and money launderers steal from one another. Every conversion creates dependency on an intermediary. Those dependencies are defensive opportunities.

For cryptocurrency organizations, the relevant cyber key terrain is not only the blockchain or wallet. It includes developer laptops, source repositories, package registries, CI/CD, cloud identity, browser sessions, messaging accounts, signing devices, multisignature interfaces, transaction simulation, policy engines, executive approval, support vendors, and recovery communications. Separate the environment where untrusted code is reviewed from the environment where production and wallet authority exist. Require independent display and verification of transaction intent. Treat a developer with signing-path influence as a privileged financial operator.

The human supply chain: when a job applicant is the operation

Remote work gave North Korea something a conventional intrusion must fight to obtain: a legitimate account, a managed laptop, payroll, source-code access, meetings, internal documentation, and colleagues trained to trust the person they hired. Thousands of DPRK IT workers have sought contracts under false, stolen, or borrowed identities. Many are skilled developers performing real work. That is what makes the scheme durable.

The worker program has at least four possible outcomes. Salary generation sends foreign currency toward the state. Trusted access exposes intellectual property, credentials, customer data, and production systems. Theft or extortion can follow when access is ending or a dispute arises. Operational support can provide identities, infrastructure, and knowledge useful to separate malicious teams. These outcomes are possible, not automatic in every case; responders should investigate facts rather than treat every foreign contractor as a spy.

U.S. cases make the infrastructure visible. The Chapman sentencing record describes a U.S.-based “laptop farm” that made overseas workers appear local, involved more than 300 companies, and generated more than $17 million. In June 2025, the 2025 nationwide laptop-farm actions covered searches across sixteen states, about 200 computers, financial accounts, fraudulent websites, front companies, and schemes involving more than 100 employers. In April 2026, a 2026 laptop-farm sentencing described another network that generated $5 million and used at least eighty stolen identities.

This is not only an American problem. The 2025 MSMT cyber report summary estimated that 1,000–2,000 DPRK IT workers were present in at least eight countries and that workers associated with sub-organizations of sanctioned nuclear and munitions bodies remitted roughly half their income. The Republic of Korea, United States, and Japan warned in their 2025 ROK–U.S.–Japan IT-worker statement that workers use false identities, location obfuscation, AI, and facilitators while seeking contracts in North America, Europe, and East Asia. A broader 2026 multinational IT-worker warning reinforced the need for government–industry action.

Recruitment can also run in the opposite direction. Instead of applying for a job, North Korean actors pose as employers and approach developers. The new 2026 WaterPlum joint advisory reports that WaterPlum/Contagious Interview infected at least 30,000 devices in more than 100 countries between about December 2025 and July 2026, and took funds or credentials from more than 7,000 cryptocurrency wallets. It describes attractive roles at purported AI, cryptocurrency, or NFT companies, followed by a technical interview or coding assignment that asks the candidate to execute a malicious project. The campaign reportedly transferred at least ¥1.7 billion—about $10.71 million—to the DPRK. Japan also reported dismantling its first identified laptop farm.

The two systems meet. The advisory links shared IP addresses used for WaterPlum activity, laptop farms, crowdsourcing, and an application to a Japanese cryptocurrency exchange. Stolen identity images can seed worker personas; a worker can provide corporate access; a malicious recruiter can compromise the developer who holds that access. Microsoft’s Microsoft Jasper Sleet analysis documents identity, location, remote-access, and account anomalies that defenders can join across hiring and security data.

Generative AI improves scale and presentation, not magical capability. Google’s Google AI threat analysis observed DPRK-linked actors using AI for research, language assistance, lures, reconnaissance, and operational support. Its Google UNC1069 investigation documented a 2025 campaign using a compromised messaging account, a fake meeting, reported AI-generated video, and multiple credential- and data-stealing tools. AI can help bridge language gaps and create a convincing face; it does not erase inconsistent identity history, device telemetry, payroll flows, impossible travel, or access behavior.

Defend the whole employment lifecycle. Independently verify identity and location; contact references through known channels; confirm that skills can be explained, not merely listed; prohibit applicants from running untrusted code on corporate or wallet-connected systems; ship devices only to verified people; inspect remote administration; correlate identity, endpoint, cloud, source-control, and finance signals; apply least privilege and separation of duties; and plan an evidence-preserving offboarding path. Hiring, procurement, security, legal, sanctions, finance, and insider-risk teams must share a case model.

Espionage and conflict preparation: steal the decision, the design, and the future option

Financial headlines can obscure North Korea’s first-order intelligence mission. A negotiation brief, sanctions analysis, military exercise plan, weapons design, vulnerability report, or private assessment of leadership intentions may be more strategically valuable than an immediate outage.

Kimsuky’s recurring targets—diplomats, think tanks, academics, journalists, human-rights organizations, defectors, and nuclear or Korean-policy specialists—show collection close to decision-making. Social engineering often impersonates a trusted colleague, requests comment on a document, or continues a real policy conversation. Compromise can reveal not only final reports but who influences whom, what governments believe, where allies disagree, and which sanctions or negotiations are being prepared.

Defense and technology collection follows a different path. The 2024 allied Andariel advisory describes targeting of defense, aerospace, nuclear, and engineering organizations. The Justice Department’s health-sector ransomware case says the same activity stole terabytes of information, including material related to military aircraft, maritime systems, and uranium processing. Microsoft has separately tracked North Korean clusters against aerospace and defense targets. These operations can support military research, procurement, targeting knowledge, countermeasure development, or simply a clearer view of an adversary’s capabilities.

Supply-chain access multiplies reach. The 2023 compromise of 3CX turned a trusted desktop application into a path toward selected downstream cryptocurrency targets; Google attributes the cluster it calls UNC4736 to North Korean espionage. The strategic lesson is not that every North Korean operation seeks mass infection. A broad delivery mechanism can serve narrow follow-on selection. Count the organizations exposed, compromised, selected, and exploited separately.

In a Korean crisis, likely missions would include political and military warning, collection on alliance decisions, disruption of mobilization and logistics, pressure on civilian confidence, theft of operational data, attacks on command-supporting suppliers, and influence activity that magnifies real or claimed effects. Public history demonstrates pieces of this portfolio; it does not prove persistent access to every critical system or the ability to produce national paralysis on demand.

North Korea’s own network isolation creates an asymmetry. Most citizens do not have open global internet access, while selected institutions and operators can use controlled networks and overseas infrastructure. That reduces some ordinary domestic exposure and supports information control, but it does not make military, industrial, financial, telecommunications, or leadership systems invulnerable. Public insight into DPRK defensive architecture, incident response, dependencies, and damage is extremely limited. Capability rankings that score offense without this uncertainty are incomplete.

Mature cyber campaign design asks what decision or mission the operation supports. Stealing an aircraft document is not the same as manufacturing an aircraft. Reading exercise plans is not the same as defeating the exercise. Disrupting a supplier may delay a unit without changing a war. Track the chain from access to information, from information to institutional use, and from use to measurable effect.

Defenders should prioritize identities near decisions and designs: policy staff, researchers, defense engineers, source-code maintainers, cloud administrators, translators, recruiters, cryptocurrency operators, and the personal accounts through which trust is established. Protect email authentication and forwarding rules; use phishing-resistant authentication; isolate sensitive research; monitor repository and cloud exports; control third-party access; rehearse loss of communications; and ensure executives can make decisions from verified reporting during a leak or disruption campaign.

The 2026 assessment: formidable reach, real constraints, and a defense built around trust

North Korea is a highly capable cyber power, but “top tier” is too blunt to guide defense. Its strongest demonstrated capabilities are persistent social engineering, patient intelligence collection, compromise of developers and trusted software paths, large-scale financial theft, fast laundering, global identity and facilitation networks, and the ability to combine legitimate work with covert state objectives. It has repeatedly adapted after attribution and sanctions.

Four evidence bins keep the assessment honest:

1. Demonstrated and officially attributed: Sony’s destructive theft-and-leak campaign; the Bangladesh Bank and wider SWIFT conspiracy alleged in U.S. cases; WannaCry; major cryptocurrency thefts including Ronin, DMM Bitcoin, and Bybit; Kimsuky intelligence collection; Andariel espionage and ransomware; overseas IT-worker networks; and the newly exposed WaterPlum campaign.
2. Strongly supported strategic assessment: cyber revenue contributes to the DPRK state and prohibited weapons programs; intelligence collection supports national and military priorities; operators and workers use foreign facilitators and infrastructure; and different missions share services, identities, or access.
3. Plausible wartime capability: using prepositioned access for disruption, logistics interference, command-support targeting, or psychological pressure in a Korean conflict. Historical behavior supports the possibility, but target-specific access and effects remain unknown.
4. Unknown or contested: exact headcount, budget, current command chart, leadership approval for individual operations, access inside critical infrastructure, stockpiled vulnerabilities, domestic defensive resilience, the precise destination of every stolen asset, and the strategic value of stolen technical data.

Constraints are real. North Korea operates under sanctions, limited direct connectivity, restricted access to advanced hardware and services, and intense international scrutiny. It must reach global targets through foreign hosting, stolen accounts, proxies, brokers, facilitators, and workers abroad. Cryptocurrency must ultimately be converted or spent. Public attribution exposes infrastructure and training value. Aggressive theft causes platforms and governments to cooperate. Tooling and operations can fail, as WannaCry’s poor monetization and kill switch demonstrated.

Yet these constraints also shaped the model. Rather than build everything at home, the state exploits the openness of global labor, software, cloud, finance, and identity systems. The “perimeter” may be a recruiter’s direct message, an engineer’s personal laptop, a residence hosting twenty employer devices, a borrowed passport image, a package dependency, or a broker willing to convert funds. North Korea’s advantage is often the seam between departments and jurisdictions.

Daily defense should therefore be organized around trust transitions:

• People to identity: independently prove who is being hired, contracted, paid, or granted access, while avoiding nationality-based profiling.
• Identity to device: verify where devices go, who controls them, what remote tools are present, and whether location and behavior agree.
• Developer to code: isolate untrusted projects, protect repositories and CI/CD, review dependency changes, and separate development from financial signing.
• Access to authority: use least privilege, short-lived sessions, phishing-resistant authentication, dual control, transaction simulation, and out-of-band verification.
• Detection to response: preserve endpoint, identity, email, cloud, source-control, DNS, proxy, payroll, and wallet evidence; revoke sessions; protect affected identities; move exposed assets safely; and contact relevant authorities quickly.
• Incident to public meaning: distinguish confirmed access, theft, disruption, attribution, and strategic effect. Do not amplify an actor’s claim before validation.

Law, sanctions, intelligence, diplomacy, platform action, and criminal prosecution all matter because no single defender owns the complete network. The ending of the UN Panel of Experts’ mandate in April 2024 after a Russian veto reduced one monitoring mechanism; the eleven-country MSMT was created later that year to continue evidence collection outside the Security Council structure. Exchanges, employers, code platforms, cloud providers, banks, identity holders, investigators, and governments each see a different segment.

The final judgment is not that North Korea can “hack anything.” It is that Pyongyang has built an unusually integrated system in which cyber access can become intelligence, money, technology, coercion, or a future military option. Its most consequential innovation is organizational: a developer interview, a remote employee, a software update, a bank message, and a cryptocurrency transfer can all be operational terrain. Defenders operate better when they stop treating those as separate security problems and start protecting the trust that connects them.