Dark Side
Shadowy North Korean IT group believed hiding out in Russian Far East: sources
By Kyodo, Feb 18, 2018
Feb 19, 2018 - 9:37:45 AM

VLADIVOSTOK – A group of North Korean information technology experts has moved its base from Hong Kong to Vladivostok in Russia and is likely engaged in collecting foreign currencies there, sources familiar with the matter said Sunday.

Since allowing such activities in the Russian Far East could violate the U.N. Security Council’s resolution prohibiting nations from authorizing new permits for North Koreans working abroad, Russia’s security authorities have been on alert, the sources said.

While North Korean hackers have been blamed for conducting cyberattacks around the world, including last year’s virtual currency heist in South Korea and the WannaCry ransomware attack on over 150 countries, the Vladivostok group has not been reported as involved in a cyberattack.

The North Korean group in Vladivostok consists of five to seven members believed to be in their 20s and 30s, with some skilled in English, Chinese and Japanese. They moved to Vladivostok last October to evade U.N. and Chinese sanctions, according to the sources.

“We had been working in China for about five years but became unable to continue our work due to sanctions,” one member was quoted by the sources as saying. Another source close to China and Russia said they are paid far more than their Korean compatriots engaged in construction and agriculture.

Facing deeper economic sanctions, North Korea is believed to have expanded activities aimed at acquiring foreign money through hacking and e-commerce. The Vladivostok group is believed to answer to Pyongyang as well, according to the sources.

In Hong Kong, the group developed an online inventory and order management system and is now negotiating with Russian firms to receive orders, the sources said, adding that it is believed to be accepting orders from Japan as well, with the help of ethnic Korean residents in Russia and brokers in Japan.