Cyberattacks targeting South Korea's military jumped to a five-year high of 18,951 incidents last year, even as the specialist officers trained to counter such threats are leaving the armed forces in large numbers after completing their mandatory service. With signs emerging that North Korea is leveraging AI to sharpen its hacking capabilities, calls are growing for urgent action to recruit and retain cyber talent in the military.
People Power Party lawmaker Yoo Yong-won, a member of the National Assembly's National Defense Committee, released data Sunday based on figures submitted by the Ministry of National Defense showing that cyberattacks on the South Korean military fell from 11,700 in 2021 to 9,115 in 2022, then climbed to 13,599 in 2023, 14,419 in 2024 and 18,951 last year. The figure for last year represents an increase of more than 108 percent compared with 2022 and more than 31 percent compared with 2024, making it the highest in the past five years.
By attack type, attempted website intrusions accounted for the vast majority, reaching 18,792 cases last year. Phishing emails — designed to impersonate trusted senders and trick recipients into opening malicious attachments — also rose steadily, from 16 cases in 2023 to 96 in 2024 and 127 last year, pointing to a diversification of attack methods.
The Cyber Operations Command said that "due to the nature of cyberattacks, which involve IP spoofing and routing through overseas nodes, there are limits to identifying the perpetrators of attacks on our military." It added, however, that "traces of AI being applied to North Korea's existing hacking techniques — including malware development and attempts to infiltrate organizations under false identities — have been detected, suggesting that North Korea's hacking capabilities are becoming increasingly sophisticated."
South Korean military intelligence estimates that North Korea operates a hacker force of about 8,400 personnel centered on the Reconnaissance General Bureau under the General Staff. These operatives route their activities through overseas IP nodes in third countries to evade tracking, and continue to pose cyberattack threats — including building phishing sites, distributing phishing emails and stealing virtual assets — with the aim of obtaining military intelligence and generating foreign currency.
Meanwhile, the military's ability to secure specialist cyber personnel is deteriorating.
To develop the expertise needed to counter increasingly sophisticated cyber threats, the military operates a cyber specialist officer program, under which students selected from designated university departments receive tuition support — amounting to tens of millions of won per person — through a military service incentive grant. After graduating and receiving their commissions, they are assigned to units including the Cyber Operations Command and the 777 Command, where they carry out missions in cyber threat analysis, security and forensic investigation.
However, a large share of the cyber specialist officers produced under the program have since left the military. Of the 104 officers commissioned between 2016 and 2019, 89 — about 85 percent — left after completing their seven-year mandatory service obligation. More than eight out of every 10 personnel trained at public expense chose not to extend their service. An additional seven officers were discharged early before completing their mandatory service due to illness or other reasons.
Recruiting new talent has also become a problem. The commissioning rate for cyber specialist officers stood at about 96 percent in 2016 and about 92 percent in 2017, but plunged last year, with only 7 of 24 graduates receiving commissions. Analysts attribute the trend to sharply improved demand and compensation for AI and cybersecurity professionals in the private sector, drawing top talent toward companies and research institutes rather than the military.
"Cybersecurity is a field that requires expertise built up over a long period of time," Yoo said. "We cannot afford to leave in place a structure in which specialist personnel leave after their mandatory service, especially when North Korea is using AI to sharpen its offensive capabilities."
He added that "it is urgent to establish a systematic management framework covering recruitment, training and long-term service, alongside improved compensation and effective incentives."
rimsclub@heraldcorp.com
