Cat-and-Mouse With Pyongyang's Hackers

South Korean experts track cyberattacks coming from their northern neighbor

- By Jamie Tarabay

Kay Kyoung-ju Kwak, a South Korean cybersecurity researcher, can usually tell when malware emanates from his neighbors to the north: They drop clues in the malicious code that show they understand their adversary. “Sometimes they put a K-pop star name in there,” he says, laughing. “They don’t like BTS.” (Instead, he says, they prefer the all-female ensemble Girls’ Generation.) Kwak says he’s also stumbled across digital evidence of North Koreans illegally downloading South Korean soap operas, presumably to entertain themselves when their shifts end.

Kwak is a threat researcher at the Seoul-based cybersecurity company S2W Inc., where he oversees a team of about 20 cybersecurity specialists called the Talon Group. The majority of them have expertise in North Korea, and they work with international law enforcement to thwart North Korean hacking attempts. S2W also has private-sector clients in e-commerce, automotive, semiconductors, and biotech.

The work can be tedious, frustrating, and, on occasion, hugely rewarding: Kwak was among the first to identify a new North Korean hacking group several years ago, christening it Andariel, after a demon also known as the Maiden of Anguish in the role-playing video game Diablo II.