Hunting for North Korean Fiber Optic Cables

Does anyone remember LAPSUS$ https://en.wikipedia.org/wiki/Lapsus$ from a while back? It was reported for a while that it was largely made up of teenagers, and it seems two did get caught. I recall their whole MO being brazen social engineering/using stolen credentials in a way that got them caught pretty quickly, but also got results fast.

Crime being illegal doesn't prevent crime, but it adds an enormous amount of friction. In the West if you are decent at hacking, low-level APIs or reverse engineering you could turn to cyber crime. But if you instead get a regular job in cyber security or software engineering you still get a good salary, and don't have to worry about your online friends being police informants, can tell your potential significant other what you do to earn a living, get money wired directly to your bank account instead of having to go through costly intermediaries with significant risks, don't have trouble with the tax authority, etc.

If you reduce the legal opportunities and remove the downsides of the illegal ones the calculation completely changes, and with it the talent pool

The world doesnt make sense if you ignore history.

They probably hack for the same reason the west does it: attack/defense and money.

If I told you today that I will pay you a million dollars to go fuck around with some North Korean servers, and doing it completely anonymously with the full protection and sanction of your government, would you say no?

I think you may have some unrealistic views on how North Korea operates internally. 99% of their population lives completely normal lives and has zero extra interactions with the government beyond basic grunt military service which is common across much of the world, and paperwork for licensing, permits, and taxes. We only see the worst possible views of North Korea from the outside, slathered with thick layers of additional propaganda on top of it.

If you only met the world on American TV, yes.

If you're worried about "absolute control over digital systems", notice how many standards get published describing how those digital systems work -- you're welcome to reimplement them if you'd like more control.

https://github.com/b30wulf/Malware-collection/blob/4f5906c93...

There was also the hacking team leak from years ago and they were selling exploits for north korea's red star OS: https://nkinternet.wordpress.com/wp-content/uploads/2025/12/...

I assume they've been on their networks in the past but i think North Korea has also done a lot over the years to secure their side. it used to be a lot easier when they left everything as an open directory and didn't realize what they were doing.

Interesting document - confirming "everyone spies on everyone". Is this from some sort of corporate NSA chat room?

Certainly political affiliations have some influence, but also China and Russia have land borders with North Korea and are not at war. It's very common to run fiber optic on/under railroads and vehicle roads, so there you go. It's probably pretty hard to attract an international cable consortium to land in North Korea given everything, but terrestrial cabling is easier to start with anyway.

> I didn't know North Korea only has 1,024 IPv4 addresses. Do you know why so few IPs? How did they get them?

They would have asked APNIC, the Regional Internet address Registry for their region (Asia-Pacific). I can't find an assignment date, but 175/8 was assigned to APNIC in 2009. 2009 lines up with wikipedia reporting of the startup of the current ISP joint venture.

As far as I know, end-user traffic from within North Korea usually does not originate from those few IP addresses. Or at least not visibly so, they might be connecting to a proxy from a DPRK IP address.

Sure it was a correct thing for Kims to do, millions of Koreans be damned.

NK is paranoid for very valid reasons.