U.S., Japan, South Korea officials brainstorm steps to counter North Korea cyberthreats at working group meet

The United States, Japan and South Korea held talks in Seoul to discuss measures to counter cyber threats posed by North Korea, the US State Department said.

At the third meeting of the trilateral diplomatic working group, officials from the three countries reviewed “substantial progress” made in deepening trilateral cooperation to disrupt Pyongyang’s ability to generate and launder revenue through malicious cyber activity.

The meeting was held in the wake of a warning issued by the US Federal Bureau of Investigation (FBI) about teams of North Korean hackers aggressively attempting to infiltrate cryptocurrency businesses and platforms using malware to steal money.

The meeting was led by Lee Jun-il, director-general for Korean Peninsula policy at Seoul’s Foreign Ministry, Seth Bailey, the US deputy special representative for North Korea, and Naoki Kumagai, the Japanese ambassador in charge of cyber policy. The working group included participants from about 20 US, South Korean and Japanese government departments, ministries and agencies.

“Through the working group, the United States, the Republic of Korea, and Japan will continue to coordinate on a wide range of trilateral actions that underscore the historic cooperation established at the Camp David Summit, including efforts to prevent DPRK cryptocurrency heists, disrupt IT activist networks, engage partners on the DPRK cyber threat, and develop trilateral capacity-building assistance efforts,” the State Department said.

“The group reviewed the substantial progress made in deepening trilateral cooperation to disrupt the DPRK’s ability to generate and launder revenue through malicious cyber activity, IT personnel, and third-party facilitators, which it uses to fund its illicit WMD (weapons of mass destruction) and ballistic missile programmes,” it said.

The three parties also discussed their approach to autonomous sanctions and the importance of private industry efforts to address North Korea’s cyber issues, the US State Department said. Earlier this week, the FBI issued a warning about teams of North Korean hackers who are aggressively attempting to infiltrate cryptocurrency businesses and platforms using malware to steal funds.

The FBI said crypto exchanges, decentralized finance (DeFi) platforms and companies associated with cryptocurrency exchange-traded funds (ETFs) are the primary targets. The Federal Bureau of Investigation said North Korean social engineering schemes are complex and elaborate, often compromising victims with sophisticated technical skills.

The FBI said that given the scale and persistence of this malicious activity, even those versed in cybersecurity practices may be vulnerable to North Korea’s determination to compromise networks connected to cryptocurrency assets.

According to the FBI, these actors conduct extensive background checks on potential victims, including their social media activities and professional networking profiles.

Using the information they have gathered, they create personalized, highly believable scenarios that specifically appeal to the victim’s background, skills and interests. These approaches often involve offers of employment, corporate investments or other lucrative and legitimate opportunities, it said.