South Korea’s Military Faces Record Cyberattacks as North Korea Expands Hacking Capabilities
In 2025, cyberattacks on South Korea’s military surged to their highest level in five years, with 18,951 incidents reported a 108% increase from 2022 and a 31% rise from 2024. The Ministry of National Defense (MND) attributed the spike to evolving threats, including phishing campaigns and North Korea’s growing cyber arsenal, which now incorporates AI-driven hacking techniques.
Key Threats and Attack Trends
The majority of attacks (18,792 cases) targeted military networks to gain administrator privileges or compromise websites. Phishing emails disguised as trusted communications also surged, jumping from 16 incidents in 2023 to 127 in 2024. South Korea’s Cyber Operations Command warned that North Korea is increasingly using AI for malware development and social engineering, including fake job applications to infiltrate organizations.
North Korea’s Cyber Expansion
North Korean leader Kim Jong-un has ordered the Reconnaissance General Bureau (RGB) the regime’s primary intelligence agency to expand its cyber and reconnaissance capabilities. The RGB, believed to control 8,400 hackers, is expected to grow further, intensifying threats to South Korea. The agency, formed from the former Reconnaissance Bureau, oversees overseas intelligence, cyber operations, and sabotage efforts against Seoul.
South Korea’s Cyber Workforce Crisis
Despite escalating threats, the MND struggles to retain cybersecurity talent. A cyber officer cadet program, launched in 2012, offers 40 million won (US$26,700) in tuition support to recruits, who serve in units like the Cyber Operations Command and 777 Command. However, 85% of officers commissioned between 2016–2019 left after mandatory service, with only 7 of 24 graduates accepting commissions in 2024. Many opt for higher-paying private-sector roles in AI and cybersecurity, despite repayment obligations for unfulfilled service.
Systemic Weaknesses and Calls for Reform
The dismantling of South Korea’s Defense Counterintelligence Command has further weakened defenses. Opposition lawmaker Rep. Yu Yong-weon criticized the lack of a long-term retention strategy, warning that the exodus of cyber specialists leaves critical gaps as North Korea rapidly advances its hacking capabilities. Without systemic reforms in recruitment, training, and retention, South Korea’s military remains vulnerable to escalating cyber threats.
Source: https://thecyberexpress.com/cyberattacks-on-south-korea-military/
Ministry of National Defense, Republic of Korea cybersecurity rating report: https://www.rankiteo.com/company/ministry-of-national-defense-republic-of-korea
Nebraska Defense Research Corporation cybersecurity rating report: https://www.rankiteo.com/company/nebraska-defense
CyberSecurity Malaysia cybersecurity rating report: https://www.rankiteo.com/company/cybersecuritymalaysia
"id": "MINNEBCYB1783974454",
"linkid": "ministry-of-national-defense-republic-of-korea, nebraska-defense, cybersecuritymalaysia",
"type": "Cyber Attack",
"date": "1/2025",
"severity": "100",
"impact": "8",
"explanation": "Attack that could bring to a war"{'affected_entities': [{'industry': 'defense',
'location': 'South Korea',
'name': 'South Korea’s Ministry of National Defense '
'(MND)',
'type': 'government/military'}],
'attack_vector': ['phishing emails',
'website compromise',
'social engineering',
'fake job applications'],
'date_detected': '2025',
'description': 'In 2025, cyberattacks on South Korea’s military surged to '
'their highest level in five years, with 18,951 incidents '
'reported—a 108% increase from 2022 and a 31% rise from 2024. '
'The Ministry of National Defense (MND) attributed the spike '
'to evolving threats, including phishing campaigns and North '
'Korea’s growing cyber arsenal, which now incorporates '
'AI-driven hacking techniques.',
'impact': {'brand_reputation_impact': 'weakened national cybersecurity '
'posture',
'operational_impact': 'critical gaps in cybersecurity defenses due '
'to talent exodus',
'systems_affected': ['military networks', 'websites']},
'initial_access_broker': {'entry_point': ['phishing emails',
'fake job applications'],
'high_value_targets': 'military networks'},
'lessons_learned': 'North Korea is rapidly advancing its hacking '
'capabilities, including AI-driven techniques, while South '
'Korea struggles with cybersecurity talent retention, '
'leaving critical gaps in defense.',
'motivation': ['intelligence gathering', 'cyber espionage', 'sabotage'],
'post_incident_analysis': {'corrective_actions': ['Reform recruitment and '
'retention strategies',
'Restore '
'counterintelligence '
'capabilities',
'Invest in AI-driven '
'cybersecurity defenses'],
'root_causes': ['North Korea’s expanding cyber '
'capabilities',
'South Korea’s cybersecurity '
'talent exodus',
'Dismantling of Defense '
'Counterintelligence Command']},
'recommendations': ['Implement systemic reforms in recruitment, training, and '
'retention of cybersecurity talent',
'Strengthen counterintelligence capabilities',
'Enhance AI-driven threat detection and response'],
'references': [{'source': 'South Korea’s Ministry of National Defense (MND)'}],
'threat_actor': 'North Korea’s Reconnaissance General Bureau (RGB)',
'title': 'South Korea’s Military Faces Record Cyberattacks as North Korea '
'Expands Hacking Capabilities',
'type': ['phishing', 'network compromise', 'AI-driven cyberattacks'],
'vulnerability_exploited': ['administrator privilege escalation',
'trusted communications impersonation']}