The Australian government on the 6th (local time) placed North Korean hacking groups that earned illegal revenue through cybercrimes such as cryptocurrency theft under sanctions. Australia said these groups stole a total of 1.8 trillion won (A$1.9 billion) in cryptocurrency worldwide last year.
The Ministry of Foreign Affairs issued a statement that day imposing financial sanctions and travel bans on four entities and one individual involved in cybercrimes led by the North Korean regime. They are accused of raising funds for North Korea's nuclear and missile program development through cryptocurrency theft and other means.
The sanctions list includes hacking groups under the Reconnaissance General Bureau, North Korea's intelligence agency. The statement designated four entities — ▲ Lazarus Group ▲ Kimsuky ▲ Andariel ▲ Chosun Expo — and individual hacker Park Jin-hyok of Chosun Expo as sanction targets. They have already been sanctioned by major countries including Korea and the United States.
Among them, Park Jin-hyok and the Lazarus Group are suspected of being deeply involved in ransomware attacks. Ransomware is a type of cyberattack that encrypts computer files and demands money in return for recovery. Kimsuky, Andariel, and Chosun Expo targeted international health systems, nuclear power plants, and think tanks as primary attack targets.
The Ministry of Foreign Affairs said the sanctions were based on a recent report by the Multilateral Sanctions Monitoring Team (MSMT). The MSMT is a team formed by 11 Western countries, including Korea, the United States, and Japan, to help implement the international community's sanctions against North Korea.
According to the report, North Korean cybercriminals stole at least A$1.9 billion (about 1.8 trillion won) in cryptocurrency from corporations worldwide over the past year. North Korea laundered the stolen digital assets through a global network. The laundered cryptocurrency was used to buy and sell military equipment and weapons-grade raw materials such as copper. The illegal cyber activity means funds flowed into the development of weapons of mass destruction (WMD) and ballistic missile programs.
In the statement, the Australian government said it would impose sanctions with the United States to pressure "North Korea's illegal revenue-generating network" and respond to security challenges. At the same time, the Australian government urged North Korea to "fully comply with the U.N. Security Council resolutions." The Australian government added, "Dismantle the illegal WMD and ballistic missile programs in a complete, verifiable, and irreversible manner."