FDD’s monograph analyzes how North Korea has developed cyber operations as Kim Jong Un’s “all-purpose sword” for regime survival, revenue, espionage, and coercion. It describes financially motivated cybercrime against banks and cryptocurrency exchanges, ransomware, and cryptomining as tools to fund state priorities, including nuclear and missile programs. The report places these operations under the Reconnaissance General Bureau and Bureau 121, while also discussing military cyber capabilities intended to disrupt command, control, communications, and civilian infrastructure in a crisis. It frames North Korean cyber activity as part of hybrid warfare, combining financial theft, intelligence collection, sanctions evasion, and potential wartime disruption.