In this presentation, the speaker explains that while most nation‑state cyber activities focus on intelligence gathering, political manipulation, and critical‑infrastructure interference, a subset of states sponsor outright cybercrime to raise funds in response to economic sanctions. Countries such as North Korea and Iran use cyber‑criminal operations as a revenue stream, targeting any victim that can be monetized. The speaker contrasts these nation‑state cybercriminals with ordinary organized cybercriminal groups, emphasizing the former’s vast state‑backed resources, legal immunity, and ability to leverage intelligence and military assets. A detailed case study of North Korea’s Reconnaissance General Bureau—known as the Lazarus Group, Hidden Cobra, or APT38—is presented, highlighting recent U.S. DOJ indictments of three members for stealing and extorting over $1.3 billion through SWIFT bank attacks, cryptocurrency exchange fraud, ATM hacks, ransomware, and phishing. The group’s sophisticated money‑laundering operations are also described. The talk concludes by urging risk professionals to incorporate nation‑state cybercriminals into their threat models, recognizing their financial motives, extensive capabilities, and evolving tactics as a significant risk to both individuals and organizations.
Chapters
Nation-state cybercriminals are a risk to everyone. Now, most nation-state activities are focused on intelligence gathering, political manipulation, interference with critical infrastructure, and sometimes even subverting military capabilities. These indirectly affect everyone but don't represent a direct threat to, well, everyday citizens. There are a few countries that sponsor cybercriminal activities, and they do target everyday people, and these really must be taken seriously. Such extreme and unethical actions by a government are usually in response to economic sanctions that have greatly restricted their ability to trade with hard currency on the open markets. That results in, well, desperate and criminal acts being committed to raise that money for the government. So this is going into the government coffers, basically. Now, when we look back in history and even today, we see countries, for example, like North Korea and Iran, and they have long sought different ways to minimize international sanctions., and cybercrime has proven a viable vehicle for that. Okay, so nation-states normally don't target citizens except for those sponsoring cybercrime. And think about this, most of the big countries out there, they do have offensive cyber operations, but most of it's around spying and intelligence gathering, right? That's really what they want to use it for, to understand what's going on in the other country. And maybe they do want to to, you know, impact it a little bit, but they're not attacking individual citizens for the most part, not your everyday kind of person. Cybercrime, well, cybercrime looks for really any victims that they can because all they're really trying to do is harvest as much money as they can and funnel it into the government accounts. So, nation-state cybercrime, it operates worldwide and it goes after targets of opportunity for the most part. Now, the difference between nation-state cybercriminals and just your regular organized cybercriminals or any of them is the amount of resources that they can bring to bear, and that can cause significant damage. In many cases, these actors are basically safe within their own country, right? There's no risk of them being arrested or anything like that. And they have the full support of that country, of their host country, to conduct these operations. And they can even leverage other resources— intelligence, military, things of that sort— and their ability to deploy those very physical resources around the world to help them as part of their cybercriminal activities. So this is something a normal cybercriminal wouldn't really have the ability to do. And well, it can make a big difference. So I'd like to introduce you to the latest from North Korea. And the US Department of Justice has just indicted these 3 individuals on suspicion to steal and extort over $1.3 billion in cash and in cryptocurrencies. Now, they work for the Reconnaissance General Bureau, and that's the the military intelligence of the North Korean government. And they're also called by, um, different names by different security groups out there and government groups. They're known as the Lazarus Group or Hidden Cobra and sometimes referred to as APT38. So they've been around for a while. These are not the only 3 individuals there, but these are 3 that are being called out, um, that the government believes that they have a case against them and they're very active, but You know, with government and nation-state-backed organizations like this, it can be very professional. I mean, as in going into an office building every day, and you know, they are constantly training and bringing more people up, and this is professional level. So these aren't the only 3, but these are the 3 that are currently being indicted, and this particular group has been around for a while. And when they're most known for is actually SWIFT bank attacks. Now SWIFT is a, um, protocol that's used between banks to transfer money, large sums of money. And so far this group has conducted several different attacks over the years in banks in many different geographies, and they've targeted over a billion dollars in bank transfers. It's amazing. The other thing they've been working on and, and doing recently is a lot of cryptocurrency hacks, and this includes, um, scammy exchange applications, various frauds and attacks, and that's netted them about $110 million. They've also branched out to ATM hacks. We've seen that happen around the world, and the estimates right now are about $6 million that they've been able to harvest out of that. But, you know, again, they're all over the place. They do ransomware, they do phishing, they do all kinds of extortion. And then once they do get all these funds, these millions and millions of dollars, they have to figure out how to launder it and get it back in. So there's complex money laundering operations they either run themselves or work with third parties so that they can get that money back in country. Now, the bottom line here is is nation states have tremendous resources and they are active in the cyber criminal space. And as risk professionals, we must understand their objectives and what their likely targets are and their rapidly evolving scope of what methods they can bring to bear. And we have to understand all of that to accurately assess the risk to us, to our organization, to our risk postures. So make sure your risk assessment process takes into account this important threat agent in addition to the other typical threat actors. It's important. They may have an impact on the individuals and the organizations. And again, they're going after financial assets.
