Operation North Korea

Background

In early March 2013, Republic of Korea and the United States began their annual joint field training exercises known as Key Resolve and Foal Eagle. Throughout the month, the tension between the two Koreas quickly escalated as both sides continued to deploy heavy military forces along the maritime border and hackers from both Koreas allegedly targeted each others’ Internet infrastructures and servers with malware and DDoS attacks. On March 29th, North Korea’s state-run news agency issued a statement that its leader Kim Jong Un approved military plans for striking American and South Korean targets.

Anonymous Korea

On March 30th, 2013, a contingent of Anonymous-affiliated hackers calling themselves AnonymousKorea^[1] claimed via Twitter that it had launched a DDoS attack against North Korea’s official websites and brought down at least five of them, including the North Korean airline Air Koryo and numerous other state news and propaganda websites.

#OpnorthKorea #Tangodown airkoryo.com.kp naenara.com.kp korea-dpr.com friend.com.kp uriminzokkiri.com
— Anonymous_Korea (@Anonsj) March 30, 2013

Notable Developments

@Anonymous_Korea’s #OpNorthKorea tweets were instantly picked up by several Anonymous-affiliated news outlets^[4] on Twitter, including @Data_Overflow, @AnonOpsKorea, @root, @iSPAINonymous @Generati0n_anon, @TheAnonOne and @AnonymousNull. That same day on March 30th, North Korea Tech^[3] and Business Insider^[2] reported on #OpNorthKorea, both suggesting that the latest DDoS attack may have been tied to the hostile threat of war that had been issued by North Korea a few hours before.

On April 2nd, Pastebin user DBLUE uploaded a brief communique^[7] explaining the background of the attack and a list of demands urging Kim Jong Un to resign as the leader and implement reforms towards democracy. The Pastebin document also included some details of two Chinese nationals and three Korean nationals, which it claimed to be part of 15,000 user records that the hackers obtained from the Chinese-hosted North Korean news site Uriminzokkiri.

We demand:

- N.K. government to stop making nukes and nuke-threats
- Kim Jong-un to resign
- it’s time to install a free direct democracy in North Korea
- uncensored internet access for all the citizens!

To Kim Jong-un:

So you feel the need to create large nukes and threaten half the world with them?
So you’re into demonstrations of power?, here is ours:

- We are inside your local intranets (Kwangmyong and others)
- We are inside your mailservers
- We are inside your webservers

However, the group’s claim that it had sucessfully breached North Korea’s local intranets remain unsubstantiated and no official statements have been issued from the North. In the following days, the alleged Pastebin leak was covered by Cyber War News^[5], North Korea Tech^[6] and The Daily Dot^[8], reporting that more attacks have been supposedly scheduled to take place on April 19th and June 25th.