North Korean hackers suspected in dozens of cyberattacks over past year

North Korean state-sponsored hacking groups have been identified as the primary suspects behind dozens of cyberattacks over the past year, according to a new security assessment from South Korea. The report from Seoul-based AhnLab Inc. details extensive cyber operations allegedly conducted by multiple North Korean advanced persistent threat groups targeting various sectors.

Lazarus leads hacking activities

The Lazarus group tops the list of suspected cyber actors with 31 documented incidents between October 2024 and September 2025, according to the software security firm's latest assessment. Authorities are investigating the group's potential involvement in a recent major cryptocurrency breach at South Korean exchange Upbit that resulted in the theft of 45 billion won ($30.6 million). The hacking techniques employed in this incident showed similarities to Lazarus's 2019 attack on the same exchange, which netted 58 billion won in Ethereum.

Multiple state actors involved

Following Lazarus, the Kimsuky group registered 27 cyber incidents during the same reporting period. Beyond North Korea's 86 total hacking incidents, the security report identified additional cyber operations originating from Chinese, Russian, Indian and Pakistani groups. These state-affiliated actors conducted numerous cyberattacks throughout the assessment timeframe, indicating a diverse landscape of international cyber threats facing South Korea and other nations.

Pattern of cryptocurrency targeting

The latest findings reinforce concerns about North Korean hackers' continued focus on cryptocurrency platforms as revenue sources. Security analysts noted that the methods used in the recent Upbit breach closely mirrored previous attacks attributed to Lazarus, suggesting consistent operational patterns despite enhanced security measures. The repeated targeting of cryptocurrency exchanges demonstrates the persistent financial motivation behind these cyber campaigns and the ongoing challenge of securing digital asset platforms against sophisticated state-sponsored actors.