North Korea’s cyberattacks targeting South Korea top the list, more than double those against the United States

[Financial News] In the first half of this year, reported cyberattacks linked to hacking groups backed by North Korea, China and Russia rose 7.5% from the second half of last year. North Korea-related incidents increased 13.8% over the same period, and South Korea was the most frequent target of North Korean groups, with more than twice as many attacks as the United States.
According to S2W's "2026 First-Half Threat Trend Report on State-Sponsored Advanced Persistent Threat (APT) Groups," released on the 16th, APT attacks attributed to North Korean, Chinese and Russian hacking groups totaled 158 in the first half of the year. That was up 11 cases, or 7.5%, from 147 in the second half of last year.
S2W said the increase was driven mainly by activity in the first quarter, when North Korean- and Russian-backed groups were especially active. By country, North Korea-related incidents were the most numerous at 99, followed by China with 33 and Russia with 26.
North Korea-related incidents rose 13.8% from 87 in the second half of last year to 99 in the first half of this year. North Korean groups repeatedly used tactics such as sending fake job offers to targets in the cryptocurrency, IT, and software sectors, as well as to developers, or hiding malware in code repositories and npm packages. Cases involving the use of artificial intelligence (AI) and deepfake technology in attacks were also confirmed.
South Korea was the most frequently targeted country by North Korean groups, with 19 cases, followed by the United States with 8. China-related incidents fell 17.5% from 40 to 33. However, the groups continued to focus on the telecommunications sector while expanding their activity to energy and military organizations, as well as to Southeast Asia and the Middle East.
Chinese-backed groups carried out long-term intelligence-gathering operations using legitimate cloud APIs, virtual private networks (VPNs), tunneling tools and the backdoor malware BPFDoor. By region, Southeast Asia was the most frequently targeted area with 8 cases, followed by the Middle East with 4.
Russia-related incidents rose 30% from 20 to 26, the highest increase among the three countries. Russian-backed groups concentrated attacks on Ukraine while broadening their targets to government and military organizations and infrastructure in Europe. In addition to intelligence gathering, they also carried out attacks aimed at system destruction and service disruption.
Ukraine was the most frequently targeted country by Russian-backed groups, with 10 cases. Activity targeting Eastern Europe, Poland and Romania was also observed twice each.
S2W said destructive activity tied to geopolitical conflicts, along with infiltration of development ecosystems and long-term access to telecommunications and infrastructure, is likely to continue in the second half of the year. It also stressed that activity by Iran-backed or Iran-linked actors should be monitored separately, as tensions between the United States, Israel and IRAN continue in the Middle East. Such attacks could indirectly affect domestic manufacturing, aviation and energy companies through the Middle East and global supply chains.
S2W stated, "We need to move beyond response measures centered on email and malware and establish an integrated defense system that covers development environments, supply chains, internet-exposed assets, cloud services and artificial intelligence (AI) analysis environments." It added, "Along with intrusion detection, we must strengthen credential rotation, impact-scope analysis, immutable backups and service recovery capabilities."

[email protected] Yeon Ji-an Reporter