151216_Cha_NorthKoreasCyberOperations_Web.pdf (4 MB)

CSIS examines North Korea's cyber operations after the 2013 attacks on South Korean banks and media agencies and the 2014 Sony Pictures Entertainment breach. The excerpt frames DPRK cyber activity as a strategic issue, asking why North Korea pursues cyber capabilities, how it organizes and executes operations, and what the implications are for U.S. and U.S.-ROK policy. The report focuses on DPRK military and political strategy, strategic use of cyberspace, the Reconnaissance General Bureau, the Korean People's Army General Staff Department, and the country's technology and industrial base. It highlights the scarcity of open-source information on DPRK cyber operations and positions the study as an English-language primer for policymakers and defenders assessing North Korean cyber behavior.