North Korea’s Ruling Elite Adapt Internet Behavior to Foreign Scrutiny
In-depth analysis of North Korean internet activity reveals the abandonment of Western social media and a dramatic increase in operational security practices.
Nota de alcance: Insikt Group examinó la actividad en Internet de la dirección más alta de Corea del Norte analizando datos de terceros, geolocalización IP, tablas de enrutamiento del Protocolo de Puerta de Enlace Fronteriza (BGP) e inteligencia de código abierto (OSINT) empleando diversas herramientas. Esto es una continuación de nuestro July 2017 analysis, and the data analyzed for this report spans from December 1, 2017 through March 15, 2018.
Executive Summary
In July 2017, Recorded Future published research on the internet browsing behavior of North Korea’s most trusted leaders, or the North’s “.1 percent.” While conducting that research, we discovered that North Korea’s ruling elite were plugged into contemporary internet society, were technologically savvy, and had patterns of internet use that were very similar to users in the West.
In December, we decided to revisit the analysis and discovered substantive changes in how North Korea’s ruling elite utilize the internet. In particular, North Korean leadership nearly totally abandoned Western social media and significantly increased their operational security procedures in the six months since our original analysis.
It is likely that this dramatic change in behavior is the result of any one, or a combination of, the following: 1) increasing foreign research into and attention to North Koreans’ media consumption, 2) new enforcement of the official ban on these Western social media services which has been in place since April 2016, or 3) increased operational security by the North Korean elite.
Key Judgements
- North Korean elites migrated almost completely from Western social media and services to their Chinese equivalents — Alibaba, Tencent, and Baidu.
- Over the course of six months, North Korean elite increased their use of internet obfuscation services by 1,200 percent. This includes a dramatic increase in services such as Virtual Private Networks (VPN), Virtual Private Servers (VPS), Transport Layer Security (TLS), and The Onion Router (Tor).
- We discovered two additional nations, Thailand and Bangladesh, where heuristic 1 analysis identified North Koreans were likely living and conducting illicit revenue-generation activities. This is in addition to eight nations we discovered in 2017, including India, Malaysia, New Zealand, Nepal, Kenya, Mozambique, Indonesia and China.
- North Korea continued to mine Bitcoin, and in late January began to mine Monero as well.
Background
Como detallamos en julio, hay unos pocos entre los líderes más altos de Corea del Norte que tienen atajo a Internet global. Aunque no hay cifras fiables de usuarios norcoreanos de Internet, los periodistas estiman que van desde "solo un número muy pequeño" hasta "el círculo íntimo del liderazgo norcoreano" o "solo unas pocas docenas de familias". Independientemente del número exacto, el perfil de un usuario norcoreano de Internet es claro: un afiliado a confianza o familiar de la clase dominante.
Hay tres formas principales en que las élites norcoreanas acceden a Internet global. Como ocurre con cualquier red conectada a Internet, ocasionalmente se reportan actividades maliciosas en estos rangos. Sin embargo, la mayoría de las operaciones cibernéticas maliciosas norcoreanas probablemente se llevan a cabo desde el extranjero (más sobre esto en la sección "Presencia en países extranjeros" más abajo).
The first method is via their allocated .kp range, 175.45.176.0/22, which also hosts the nation’s only internet-accessible websites. These include nine top-level domains such as co.kp, gov.kp, and edu.kp, and approximately 25 subdomains for various North Korean state-run media, travel, and education-related sites.
Timeline of events involving 175.45.176.0/22 range from July 2017 through April 2018.
El segundo método es mediante un rango asignado por China Netcom, 210.52.109.0/24. El nombre de red "KPTC" es la abreviatura de Korea Post and Telecommunications Co., la compañía estatal de telecomunicaciones.
Timeline of events involving 210.52.109.0/24 range from July 2017 through April 2018.
El tercer método es a través de un rango asignado, 77.94.35.0/24, proporcionado por una compañía rusa de satélites, que actualmente se resuelve a SatGate en Líbano.
Timeline of events involving 77.94.35.0/24 range from July 2017 through April 2018.
Editor’s Note
From this point on, when we refer to “North Korean internet activity” or “behavior,” we are referring to the use of the global internet, not the North Korean domestic intranet, Kwangmyong, for which only select few leaders and ruling elite are permitted access. This data does not give us any insight into intranet activity or behavior by the larger group of privileged North Koreans permitted access to Kwangmyong, or diplomatic and foreign establishments that are located in North Korea.
Additionally, we chose this date range, December 1, 2017 through March 15, 2018, because it represented a period of transition and intensified intra-Korean dialogue in advance of the February 2018 Winter Olympics in South Korea.
Analysis
Similar to international users of the global internet, North Korean elite internet activity is largely comprised of internet video, online gaming, and web browsing. A Cisco analysis revealed that 77 percent of global internet traffic in 2017 consisted of internet video and online gaming. For North Korean users, 70 percent of activity consisted of internet video or online gaming; 17 percent consisted of web browsing, checking email, and data downloads; and 13 percent was in a Virtual Private Network (VPN), or otherwise obfuscated.
Change in Social Media Consumption
North Korean leadership spent roughly the same amount of time on social media, shopping, and search sites for December through March as they did last summer. However, the services they utilized changed dramatically.
Hourly activity on eight social networking, shopping, and search sites for December 1, 2017 through March 15, 2018 (actual). Providers are listed by popularity, from Alibaba (highest) to Instagram (lowest).
In July, our data demonstrated that North Korean leadership heavily consumed Western social media, especially Facebook, Google, and Instagram. In fact, Facebook was by far the most popular service, with more than double the daily actual usage than any of its Chinese-language counterparts.
What is most striking about the social media activity from the December 2017 through March 2018 dataset is the near absence of Facebook and Instagram activity, and the significant increase in use of Chinese services. Facebook and Instagram activity are so low that they are not visible on the chart above.
In six short months, North Korean elites migrated almost completely from Western social media and services to Alibaba, Tencent, and Baidu. The remaining Western services in the top eight were utilized primarily for content streaming and not social networking.
This change in behavior could be the result of increasing foreign research into and attention to North Koreans’ media consumption, new enforcement of the official ban on these Western social media services which has been in place since April 2016, or increased operational security by North Korean elite.
Pattern of Life
North Korean leaders have distinct patterns of daily usage over this period that are similar to the summer of 2017. Generally, the times of highest activity are still from approximately 9:00 AM through 8:00 PM or 9:00 PM, with Saturdays and Sundays being the days of consistently highest activity. The peaks of activity on late Saturday nights and early Sunday mornings consisted mainly of content streaming or online gaming, suggesting that North Korean elite are allowed leisure time on the weekends.
Daily internet usage by hour (not an average).
Gaming as a For-Profit Enterprise
Un serial de entrevistas a desertores realizadas por periodistas, académicos e investigadores desde aproximadamente 2012 dio al mundo exterior una visión de los objetivos y el personal de las operaciones cibernéticas norcoreanas. Los desertores construyeron una imagen de un aparato operativo norcoreano compuesto principalmente por operadores y programadores que viven en instalaciones en el extranjero, encargados del objetivo general de generar ingresos para el régimen de Kim.
Este modelo operativo de enviar norcoreanos al extranjero para realizar operaciones cibernéticas resulta especialmente relevante al comparar los medios por los que estos hackers ganaron dinero para el régimen con el tráfico sitio web de élite norcoreana que analizamos. Los desertores detallaron hasta qué punto la falsificación y estafa de juegos de video y usuarios en línea se volvió fundamental para la generación de ingresos del régimen de Kim. Un desertor, que trabajó en una casa en China con decenas de otros hackers norcoreanos, informó que estos hombres debían ganar casi 100.000 dólares al año, de los cuales el 80 por ciento fueron enviados de vuelta al régimen de Kim. Para cumplir con este requisito, los hombres crearon juegos de video falsificados; bots que robaban objetos digitales como armas, puntos y equipo; los revendía para obtener beneficios; y descubrió y vendió nuevas vulnerabilidades en software de juegos.
The list below represents a wider usage of online games by North Korean elite since July 2017 and could give researchers leads on which games overseas North Korean hackers are exploiting to generate revenue for the regime. It is not clear how much of this type of revenue generation is conducted from territorial North Korea. However, it is clear that overseas operators would often develop bots or gaming hacks for platforms and services they were already familiar with.
- 0AD: Empires Ascendant
- Ace of Spades
- Quake
- The Marathon trilogy games
- Armed Assault 1-3
- World of Warcraft
- Cube 2: Sauerbraten
- Diablo 2
- League of Legends
- Second Life
- Accounts and games on Steam
North Korean elite also utilize a number of gaming consoles or systems, including Nintendo and PlayStation, as well as game storage and account providers like Steam and Blizzard.
Presence in Foreign Countries
In our July research, we developed a heuristic to identify significant physical and virtual North Korean presences in nations around the world. That heuristic included above-average levels of North Korean internet activity to and from these nations, but also browsing and use of many local resources, such as news outlets, district or municipal governments, local educational institutions, and more.
This technique enabled us to identify eight nations where North Koreans were physically living or located, including India, Malaysia, New Zealand, Nepal, Kenya, Mozambique, Indonesia, and China. For this December through March dataset, we reexamined the data for those eight countries and included examples of countries that did not fit the pattern in order to provide greater fidelity on the analytic conclusions.
Top export destinations for North Korea in 2015 (data courtesy of MIT Observatory of Economic Complexity). China, India, Indonesia, Thailand, Bangladesh, Nepal (as part of “Other Asia”), and Mozambique fall within this list of top export destinations.
Among the eight identified last summer, only Malaysia and New Zealand no longer fit the behavioral heuristic, but in slightly different ways.
En Nueva Zelanda, aunque el volumen de tráfico se mantuvo relativamente estable, la actividad ya no mostraba la segunda mitad de la heurística (recursos locales y más) y en su lugar parecía ser principalmente un centro para bittorrent, streaming de video y servicios de juegos de video norcoreanos. Durante un periodo de tres días a principios de enero, una IP de las Fuerzas de Defensa de Nueva Zelanda intentó conectarse repetidamente con redes norcoreanas. La actividad era repetitiva y ruidosa, pero no alcanzaba el nivel que pudiera causar una interrupción en los servicios de Internet norcoreanos.
It is possible that New Zealand countered some North Korean operational activity through actions it undertook in August 2017 to deny visas to North Korean academics and its support for United Nations and United States sanctions regimes.
For Malaysia, the volume of traffic dropped significantly, but there are clearly some North Koreans in Malaysia. For example, we see repeated checking of North Korean official email accounts from Kuala Lumpur, however, the breadth of the localized North Korean activity is much narrower than last summer.
Las relaciones entre Malasia y Corea del Norte se deterioraron significativamente desde el verano pasado y tras el asesinato de Kim Jong-nam. Malasia retiró a su embajador en Pyongyang, impuso restricciones a los trabajadores invitados, compañías y vuelos norcoreanos, impuso una prohibición de viajes y podría exigir a Corea del Norte que reduzca el tamaño de su misión en Kuala Lumpur.
In addition to the remaining six nations — India, Nepal, Kenya, Mozambique, Indonesia, and China — internet activity involving two other nations emerged as fitting the behavioral signature: Thailand and Bangladesh. We assess that these eight nations wittingly or unwittingly host North Koreans. These North Koreans are likely conducting illicit revenue-generation activities with the intent of circumventing international sanctions or obtaining advanced education, with the goal of progressing the North’s nuclear weapons and cyber operations programs.
In part one of our research on North Korea’s strategic motivations for conducting cyber operations, we detailed some of the extensive overseas criminal operations that the Kim regime runs to obtain funding for the country’s missile and nuclear development programs.
Las redes ilícitas de ingresos de Corea del Norte fueron estudiadas extensamente por investigadores, periodistas y académicos. Estos estudios, y muchos más, detallan cómo Corea del Norte emplea sus establecimientos diplomáticos en el extranjero, la cadena estatal de restaurantes y los ciudadanos que viven en el extranjero para facilitar la generación ilícita de ingresos y la formación en operaciones nucleares y cibernéticas.
Tailandia y Bangladesh albergan restaurantes estatales norcoreanos, establecimientos diplomáticos vinculados a actividades delictivas y permiten la inversión norcoreana. La firma digital que desarrollamos y aplicamos es simplemente un dato más que refuerza nuestra confianza en incluir a estas dos naciones en esta lista.
High Volume But No Signature Match
There are several countries that exhibited high volumes of activity with North Korean ranges but did not meet the second, or local, half of the heuristic. Particularly among the top 10 nations, the majority of these nations were simply utilized by North Korean users for video streaming, content delivery, or VPN/VPS services.
Top 10 nations with the most internet activity to or from North Korea (actual numbers).
Interestingly, Alibaba’s video streaming and content delivery networks seem to be routing North Korean-originated traffic through U.S. servers, which was the major driver of U.S.-based activity. In the case of the Netherlands and Germany, infrastructure in both nations was utilized heavily to obfuscate activity, primarily through VPN or VPS services and Tor exit nodes.
This is in stark contrast to last summer, when less than one percent of all North Korean internet activity was obscured or concealed in any way. The drivers for this move to European providers is not clear, however, we assess it could be driven by the implementation of the GDPR and the European focus on individual internet privacy.
Cryptocurrency Activity
Since our initial reports that North Korea had been mining Bitcoin since at least May 2017, the North’s interest in and exploitation of cryptocurrencies has exploded. In 2017, North Korea committed numerous thefts from South Korean cryptocurrency exchanges, was linked to the May WannaCry attack, and has begun to mine Monero.
In this new dataset, we see an expanded interest in cryptocurrencies by North Korean elites and a continuation of the Bitcoin mining. While our data does not give us insight into the full scope of North Korea’s Bitcoin activity, we saw a continuation of the mining activity we observed in May from January 24 through the end of this dataset on March 15. The traffic volume and rate of communication with peers was the same as last summer, but we were still unable to determine hash rate or build. This mining effort appears small-scale and limited to just a few machines, similar to the activity from last summer.
También vimos un usuario probablemente separado empleando la interfaz Bitcoind , que permite el control local o remoto e integración con otro software, o en sistemas de pago más grandes. Esto es un indicador fuerte de que los usuarios norcoreanos están realizando transacciones con Bitcoin, pero no podemos confirmar qué se compró, las carteras asociadas ni cuántas monedas poseía el usuario.
Además de la actividad de Bitcoin detallada arriba, a partir del 29 de enero observamos la minería de Monero desde redes norcoreanas. Esta actividad continuó hasta el final de nuestro conjunto de datos el 15 de marzo. La minería de Monero es similar a la minería de Bitcoin en que emplea el mismo método de "prueba de trabajo", donde se debe encontrar el hash que coincide con un determinado valor objetivo.
Monero se distingue de Bitcoin en que Monero es verdaderamente anónimo. Todas las transacciones están cifradas dentro de la blockchain para que solo el emisor o receptor de una transacción pueda descubrir la otra. Monero también se diferencia porque fue diseñado para ser explotado por máquinas de menor capacidad , y sus puertos mineros tienden a escalar según la capacidad. Por ejemplo, muchos mineros usan el puerto 3333 para máquinas de gama baja y el puerto 7777 para máquinas de gama alta y mayor capacidad. En este caso, observamos la minería sobre el puerto 7777, lo que sugiere que una máquina de mayor capacidad estaba realizando la minería, y también una tasa de hash más alta. Los números de puertos y la actividad que observamos no eran suficientes para determinar la tasa de hash; lo único que pudimos evaluar fue que se estaba produciendo minería.
Obfuscated Activity
A much higher percentage — nearly 13 percent — of leadership internet activity was obfuscated in some way for this time period, as opposed to the less than one percent of activity last summer. From April through July 2017, less than one percent of all North Korean internet activity was obfuscated. Over the course of approximately six months, North Korean leadership significantly changed the manner in which they browse, search, and retrieve web content.
North Korean leadership use of obfuscation services by percentage of total.
El Protocolo de Tunelización punto a Punto (PPTP) fue el servicio de ofuscación más empleado, seguido probablemente por HTTPS (a través del puerto 443), o navegación segura, y la VPN IPSec.
From April through July 2017, North Korean leadership obfuscated less than one percent of all of their internet activity — this included TLS-enabled browsing, the use of VPN or VPS, and other tunneling protocols, or even the use of Tor. By December, North Korean users had fundamentally altered their browsing behavior, increasing their use of obfuscation services twelvefold.
Given that 70 percent of North Korean internet activity consists of internet video or online gaming, 13 percent is a substantial portion of the remaining web traffic, which narrows our optic into leadership activities even further.
Network Analysis
On October 1, 2017, researchers observed that a Russian telecommunications company, Trans TeleCom (AS 20485), began appearing in the internet routing databases for North Korea’s primary IP range, 175.45.176.0/22. Prior to October 2017, North Korea’s principle connection to the global internet had been provided by Chinese telecommunications company, China Unicom (AS4837).
En diferentes momentos del 1 de octubre, tres de las cuatro subredes de 175.45.176.0/22 (175.45.176.0/24, 175.45.177.0/24, 175.45.178.0/24 y 175.45.179.0/24) fueron enrutados por Trans Telecom hasta que la conexión se estabilizó y entonces solo el 175.45.178.0/24 la subred permaneció en tránsito sobre la infraestructura de Trans Telecom, mientras que las otras tres empleaban China Unicom.
From December 2017 through March 15, 2018, only the 175.45.178.0/24 subnet was ever routed through Trans Telecom, while the other three remained transiting China Unicom infrastructure. Although the Trans Telecom route has given North Korea an alternate internet access point, it seems to only be utilized for about one third of North Korea’s overall internet activity.
Usage of each subnet within the primary range of 175.45.176.0/24 by percentage of total traffic.
La subred 176 genera la mayor actividad porque aloja la gran mayoría de los sitios web de acceso público de Corea del Norte. Además, esta subred también está compuesta por varios servidores compartidos que alojan sitios web y enrutan el tráfico saliente, así como proxies y balanceadores de carga. Por ejemplo, nuestro análisis indica que Corea del Norte emplea un balanceador de carga F5 BIG-IP para distribuir el tráfico saliente a través de al menos ocho direcciones IP en esta subred. Los balanceadores de carga gestionan el tráfico de Internet entrante y saliente y lo distribuyen a un rango específico de servidores para aumentar la capacidad y la fiabilidad de la red para usuarios concurrentes.
For many who have attempted to access any of the North Korean-hosted websites, this may sound surprising because the sites are notoriously slow to load and often require several attempts before content is presented. Our analysis indicates that this load balancing is utilized primarily for the shared servers, and its performance is likely degraded by both a lack of a redundant system and the stress on the limited bandwidth due to the amount of video streaming and online gaming.
This means that there are likely more physical computers behind each of these IP addresses, although exactly how many there are is not known. The volume of internet activity we observed to and from North Korean IP ranges is quite small, especially for a national network. Because such a small percentage of the population has access to the global internet, the number of computers behind these subnets is likely to be closer to the equivalent of a medium-sized corporation than a nation with an equivalent population (approximately 25 million).
Para el 210.52.109.0/24 las tablas de enrutamiento confirman que el punto de acceso está gestionado por China Netcom, bajo AS9929. Los datos de enrutamiento también señalan que al menos la mitad de las veces, los datos de este rango se enrutan mediante un Número de Sistema Autónomo (AS o ASN) asignado a Sprint, AS1239. No está claro si este camino realmente atraviesa infraestructuras físicas en Estados Unidos o si es el resultado de una membresía conjunta en AS.
In October 2017, security researchers at an antivirus company conducted a survey of this 175.45.176.0/22 range and speculated that certain IP addresses are assigned to foreign visitors and used specifically for their internet access. This was based on seeing “web traffic” coming from thirteen IP addresses in the 175.45.178.0/24 subnet.
Our analysis indicates that “web traffic” from North Korean IP addresses is insufficient to determine use by foreigners — otherwise, this entire /22 range could be assessed as assigned to foreign visitors. We did see internet browsing, video streaming, online gaming, VPN use, and other types of traffic from the thirteen IP addresses identified. This traffic comprised less than 0.5 percent of our total observed traffic and we eliminated it from our overall analysis because it was statistically insignificant.
Outlook
Back in July, we argued that our research revealed how connected to modern internet society North Korea’s ruling elite actually were, and that international sanctions had been ineffective at isolating North Korea from the outside world. Further, we stated that new tools and relationships were needed to affect a lasting negative impact on the Kim regime.
En los meses posteriores a ese reporte inicial, observamos cambios sustanciales tanto en la forma en que la élite norcoreana emplea Internet, como en la diversidad de la participación internacional en sanciones y presión sobre el régimen de Kim. En menos de medio año, el liderazgo norcoreano cambió fundamentalmente los servicios de Internet que emplean y su comportamiento en línea para aumentar el anonimato. Recurrieron a las criptomonedas como medio para eludir las sanciones e intentaron robar fondos de instituciones financieras de todo el mundo.
Los usuarios de élite norcoreanos de Internet se están adaptando a su cambiante entorno digital, ya que las sanciones físicas siguen endurecer y coaliciones de naciones cortan la actividad con el régimen de Kim. Sin embargo, nuestra evaluación de julio de que se necesitan nuevas herramientas que no se centren en Corea del Norte territorial para lograr un impacto negativo duradero en el régimen actual de Kim sigue vigente. El Panel de Expertos de las Naciones Unidas sobre Corea del Norte sigue centrar estrechamente en el robo cibernético de secretos militares, y las sanciones estadounidenses aún no abordaron las operaciones cibernéticas.
The breadth of North Korea’s embrace of the internet, from leadership browsing, to revenue generation, to tactical cyber operations, indicates how indispensable this medium is to the Kim regime. International efforts to restrict the activities and operational scope of this rogue nation must include sanctions or punitive measures on North Korean cyber operations.
For cybersecurity professionals and network defenders, this change in leadership internet behavior continues to underscore just how complex defending against malicious North Korean cyber activity can be. We continue to recommend that financial services firms, banks, cryptocurrency exchanges, users, those supporting U.S. and South Korean military THAAD deployment, and on-peninsula operations maintain the highest vigilance and awareness of the heightened threat environment to their networks.
Similarly, energy and media companies, particularly those located in or that support these sectors in South Korea, should be on alert to a wide range of cyber activity from North Korea, including DDoS, destructive malware, and ransomware attacks. Broadly, organizations in all sectors should continue to be aware of the adaptability of ransomware and modify their cybersecurity strategies as the threat evolves.
1Heuristic analysis refers to a problem-solving approach that leverages methodical approximation to derive an analytical outcome based on the application of several criteria on the underlying data. In this case, it is the result of in-depth analysis of a large dataset combined with an intimate knowledge of the likely operating environment of North Korean nationals based in foreign countries.
2Eight is not a magic number — it just seems to be the number of countries where the behavior fits the signature.