North Korea
East Asia · capital Pyongyang · cyber picture, physical security and relations with the EU on one page
Who targets North Korea
All 2 actors →
South Korea (1)| Actor | Suspected sponsor | In its news · 30d | Techniques |
|---|---|---|---|
| TraderTraitor named in the news only | North Korea |
24 | — |
| Lazarus Group named in the news only | North Korea |
5 | 30 |
| Kimsuky named in the news only | North Korea |
1 | 130 |
| Pearl Sleet named in the news only | North Korea |
1 | — |
| Higaisa | South Korea |
— | 28 |
| Gelsemium | not attributed | — | — |
Cyber news 30 days
Every cyber article that mentions it →- Binance says all asset losses from N. Korea-linked cyberattack covered
- North Korea’s $6.36B crypto heist, and the hidden lives of its IT workers
- How hacking became a key weapon for sanctions-hit North Korea
- Pyongyang denies Binance hack, but its own spy disagrees
- FBI-wanted N. Korean hacker back in spotlight
- US calls for coordinated action against N. Korean cyber threats following Binance hack
- North Korea's army of world-class hackers is secret weapon that took down Binance
- North Korea rejects Binance hack accusation, warns against US talks
- U.S. reiterates concerns over N. Korean cybercrime following Kim Yo-jong's denial of Binance theft
- North Korea slams US for ‘trite provocation,’ denies responsibility for Binance hack
Exploited vulnerabilities in its news 90 days
Incidents
Register →Cyber threat landscape as described in the country report of Nov 11 Machine-generated
The cyber threat landscape for North Korea during this period was dominated by the ongoing fallout from a massive cryptocurrency heist. On November 4, 2026, North Korea, through Kim Yo Jong, vehemently denied FBI accusations that its state-sponsored hacking group, TraderTraitor, was responsible for stealing over $6 billion from the Binance cryptocurrency exchange. Binance itself revealed that the attack, which began in June 2026, originated from a supply chain compromise targeting one of its engineers, who downloaded a trojanized Homebrew installer for an AI tool. This incident highlights the sophisticated methods employed by North Korean actors, including the use of fake interview schemes and AI tool abuse to gain initial access and exfiltrate private keys from cloud storage.
According to TRM Labs, North Korea-backed hackers have stolen an estimated $12.8 billion in crypto since 2017, with a staggering $7.4 billion of that occurring in 2026 alone, accounting for 85% of all crypto hack value worldwide this year. These illicit revenues are critical for funding North Korea's nuclear weapons program and sustaining its economy in the face of international sanctions. The scale and frequency of these attacks demonstrate a persistent and evolving threat from Pyongyang's cyber operations, which indiscriminately target global cryptocurrency exchanges and commercial platforms.
A cyber incident recorded in October 2026 involved a prankster appearing to hack the voicemail of North Korea’s UN mission to mock the country, indicating a continued vulnerability to less sophisticated, but publicly embarrassing, attacks. Background: Threat actors known to target North Korea include Higaisa (South Korea-linked) and Gelsemium. Other threat actors named in North Korea's news in the last 30 days include Lazarus Group (mentioned in past large heists against CoinEx and Bybit), Kimsuky, and Pearl Sleet. Exploited vulnerabilities named in its news in the last 90 days include CVE-2026-104935 (Ivanti Connect Secure), CVE-2026-111497 (Google Brotli), CVE-2015-1000013, CVE-2026-76418 (Cisco Secure Firewall ASA Software and Cisco Secure FTD Software), CVE-2026-98432, and CVE-2026-118539.
Hotspots from the country report of Nov 11
Machine-generated- High Sondok, North Korea — Site of multiple missile launches towards the East Sea.
- Elevated East Sea (Sea of Japan) — Target area for North Korean missile tests, increasing regional maritime and air security concerns.
- Elevated Nampho Shipyard, North Korea — Location where Kim Jong Un inspected the construction of a new, advanced warship.
- High Demilitarized Zone (DMZ) — Area of heightened inter-Korean tensions due to landmine incidents and North Korean border fortifications.
- Elevated North Korea-China Border (Sinamrok River Bridge/Dandong) — Symbolizes the strengthening North Korea-China-Russia axis and facilitates sanctions evasion.
- High Pyongyang, North Korea — Center of political decisions, denials of cyberattacks, and diplomatic rejections.
Threat level last reports
Machine-generatedLatest country report
Read the full report →Relations with the EU
Factsheet →- 4 EU cooperation projects · 3 active
- No EU Digital & ICT project recorded here
- No trade or cooperation agreements on record
EU relations and implications country report of Nov 11
Machine-generatedNorth Korea's relations with the European Union during this period were characterized by sharp condemnation and ideological friction. On November 5, 2026, North Korea's state media reported a strong rebuke of the EU's draft UN resolution on human rights, with Pyongyang's UN mission telling the bloc to "mind its own business". North Korea dismissed the resolution as a "farce" and a "politically-motivated provocation," accusing the EU of hypocrisy by pointing to alleged protests and police violence in European cities like Paris and Brussels. This exchange highlights the deep chasm in values and priorities, with North Korea consistently rejecting external criticism of its internal affairs.
The security and cyber developments, particularly North Korea's reliance on illicit cyber activities to fund its nuclear program and its strengthening ties with China and Russia, have significant implications for EU interests. The EU, as a proponent of international law and human rights, finds its diplomatic efforts and existing cooperation projects (Peace & Security, Humanitarian, Education & Skills, Development Cooperation) undermined by Pyongyang's actions and its rejection of dialogue. The North Korea-China-Russia axis, which actively ignores international sanctions, diminishes the effectiveness of EU-supported international pressure campaigns aimed at denuclearization and human rights improvements. This makes any meaningful security or digital cooperation with North Korea virtually impossible, as the regime prioritizes self-preservation and military advancement over engagement with Western norms and interests.
Previous reports
Machine-generated- North Korea Security Report — November 08, 2026
- North Korea Security Report — November 06, 2026
- North Korea Security Report — November 04, 2026
- North Korea Security Report — November 03, 2026
- North Korea Security Report — November 02, 2026
- North Korea Security Report — November 01, 2026
- North Korea Security Report — October 31, 2026
- North Korea Security Report — October 29, 2026
- North Korea Security Report — October 28, 2026
- North Korea Security Report — October 27, 2026