South Korea’s Cyber Response Options Beyond the Peninsula

Introduction

Since 2015, the Democratic People’s Republic of Korea’s (DPRK) cyber operations have evolved into one of the fastest growing and most consequential asymmetric threats in the Indo-Pacific. Unlike many cyber actors that conduct discrete or episodic operations, Pyongyang employs cyber operations as a core instrument of regime survival. Kim Jong-un went so far as to declare cyber warfare an “all-purpose sword” capable of generating coercive and strategic options across domains in 2018.

Cyber operations are all-encompassing work for the DPRK government. The DPRK operators who pilfer cryptocurrency also fund Pyongyang’s weapons programs. Intelligence collection supports those weapons programs, while simultaneously creating access vectors for future operations and proceeds. The threat is transnational in every dimension—DPRK operators sit in Shenyang and Vladivostok, laundering proceeds through Cambodian platforms and Chinese over-the-counter (OTC) brokers. They target victims ranging from U.S. healthcare systems to global cryptocurrency exchanges.

The Republic of Korea (ROK) possesses technical talent and intelligence capabilities, but the absence of comprehensive national cyber legislation and limited authority constrain the government’s ability to act at the speed and scale the threat demands. This paper maps the operational landscape across three DPRK strategic objectives and proposes a layered response strategy that leverages South Korea’s strategic position, U.S.-ROK bilateral cooperation, and multilateral coalition-building to counter the growing threat the DPRK poses.

Jiwon Ma is a senior policy analyst at the Foundation for Defense of Democracies’ Center on Cyber and Technology Innovation, where she contributes to the CSC 2.0 project.