Cyberattack attempts against South Korean military units have more than doubled over a three-year period [1].

The surge represents a strategic shift by North Korea to treat cyber capabilities as a weapon comparable to its nuclear and missile forces. By targeting the Republic of Korea’s armed forces and related defense, energy, and biotech sectors, Pyongyang aims to acquire advanced technology to bolster its own capabilities [1], [2].

North Korea operates an estimated 8,000 hackers through its Reconnaissance General Bureau [1]. These operatives are increasingly integrating artificial intelligence to develop and deploy malicious code more efficiently. This AI-driven approach allows hackers to identify dozens of vulnerabilities and create hacking tools within a window of one day to one week [2].

Kim Jong-un said that cyber forces are a "treasure sword" equivalent to nuclear and missile assets [2]. This prioritization of digital warfare aligns with a broader geopolitical shift. South Korea classified its relations with North Korea as hostile in 2023, a move that coincided with an intensified focus on cyber defense [1].

The scale of the threat is underscored by the speed at which AI can automate the discovery of security flaws. Kim Hwi-gang said that the ability to uncover dozens of vulnerabilities in such a short timeframe is significantly threatening [2].

South Korean officials have tracked this increase by comparing data from 2020 through 2026 [1], [2]. The targeting of the energy and biotech sectors suggests that the objective extends beyond military intelligence to include the theft of critical industrial, and scientific intellectual property [1], [2].

“Cyberattack attempts against South Korean military units have more than doubled over a three-year period.”

The integration of AI into North Korea's cyber strategy marks a transition from manual exploitation to automated, high-speed vulnerability discovery. By diversifying targets to include biotech and energy, Pyongyang is treating cyber warfare not just as a tool for espionage, but as a primary engine for economic and technological leapfrogging to bypass international sanctions.