North Korea unveils new military unit targeting AI attacks

North Korea has established a new AI hacking department
The new group will be called ‘Research Center 227’
North Korea carried out many cyber offensives in 2024, including a fake interview campaign

The Democratic People’s Republic of Korea (North Korea) has established “Research Center 227” according to reports from Daily NK.

This research center reportedly plans to operate “around the clock” to immediately respond to real-time information from North Korean intelligence agencies.

“In late February, the Supreme Commander issued an order to the RGB under the General Staff Department to enhance overseas information warfare capabilities. This order included instructions to establish Research Center 227 for hacking technology research” a source told Daily NK.

Persistent operations

The research center is likely to be focused on “strengthening hacking capabilities” and develop hacking technologies and programs in order to neutralize western cybersecurity systems and critical infrastructure.

These offensives will primarily aim to steal information and disrupt adversary computer networks.

The center will reportedly recruit around 90 computer experts and graduates from high-profile university and doctoral programs, the source confirmed;

“These are not cyber warriors who directly carry out information warfare missions in foreign locations, but internal research staff who develop offensive programs. With the establishment of Research Center 227, the RGB’s cyber operational capabilities will be significantly strengthened in the future.”

Cyber operations in North Korea have been launched increasingly in recent times, especially from the notorious Lazarus group, which has been observed spreading malware through various large-scale attacks, and deploying infostealers to grab credentials from western organizations.

Notably, North Korean hackers have been running the ‘Contagious Interview’ campaign with fake interviews or job adverts which prompts victims to download malware disguised as video conference software.

Also included in this campaign is a series of cybercriminals faking their identities in order to take up software jobs, most likely in order to gain access to critical service systems and information from large western firms, or other fraudulent behavior.

Source link