North Korean Internet Infrastructure Crippled by Sustained Cyberattack

POLICY WIRE — Seoul, South Korea — A series of intermittent internet outages struck North Korea this week, with analysis from U.S. network monitoring firm Kentik pointing to a cyberattack as the likely culprit. The digital disruptions persisted over a 32-hour window that commenced on Tuesday, rendering several state-managed websites inaccessible.

This is not the first time the nation’s limited web infrastructure has faced such interference. In 2022, an independent American hacker named Alejandro Caceres executed a retaliatory distributed denial-of-service (DDoS) attack against the regime’s infrastructure, a move intended to counter North Korean espionage efforts directed at Western security researchers.

Observers monitoring the situation noted that the impact was severe during the peak of the incident. Researcher Junade Ali, who tracks North Korean web and email servers, explained that the attack effectively blocked all data routing to the country, stating: When someone tries to connect to a North Korean IP address, the Internet literally cannot route their data to the country.

The outages also impacted critical government portals, including the Foreign Ministry and the Korea Central News Agency (KCNA). While some reports indicated a broader blackout lasting nearly nine hours on a Saturday morning—during which Ali described Pyongyang as being “wiped off the face of the internet”—other researchers noted that connectivity issues involving China and Russia suggested potential internal complications alongside external cyber activity.

The U.S. government and its international partners continue to monitor the Democratic People’s Republic of Korea (DPRK) for cyber espionage, specifically tracking the Reconnaissance General Bureau (RGB) 3rd Bureau, which operates out of Pyongyang and Sinuiju to support the regime’s military and nuclear ambitions.

Reporting by Policy-Wire (PW)