A long time ago, when a bill to create a cybersecurity control tower in Korea was introduced by a ruling party lawmaker, I strongly opposed it. At the time, the ruling party’s state surveillance of the public was so severe that I reacted reflexively with opposition. And I proposed that, if it should be created, it should be organized as a committee with the agreement of both the ruling and opposition parties, and at the time many people had read my writing. These days, South Korea is saying it will establish a cyber security control tower again, Japan is consolidating its intelligence agencies, and Taiwan is also reluctantly building up its power in response to China’s massive cyberattacks.
https://hyeong-chun.blogspot.com/search?q=%EC%82%AC%EC%9D%B4%EB%B2%84%EC%95%88%EB%B3%B4%EC%BB%A8%ED%8A%B8%EB%A1%A4%ED%83%80%EC%9B%8C
However, one thing is certain: compared to the cyber capabilities of countries like China or North Korea that cultivate cyber warriors under state leadership, the cyber capabilities of the free world—such as Japan, Taiwan, and even South Korea—are understood to be focused solely on defense. I have always thought this, but according to the law of relativity, Korea’s cyber power must also be expanded, and I hope that, through good consultation between the ruling and opposition parties, a cyber security control tower will be established to address the issue of surveilling citizens.
These days, my Google blog gets 10,000 views a day, and although the VPN addresses show the countries of each continent, the time of visit often aligns with the daily rhythm of Northeast Asia, prompting me to reflect once again on the cyber power of Northeast Asian countries. A couple of years ago, keeping in mind that someday we might be able to witness a cyber war, I briefly studied the Linux operating system, and now it is said that artificial intelligence—especially MitoS, an enronpic AI—has a threatening capability that renders all cyber warfare capabilities meaningless.
Now, the 007 with a shotgun and a silencer has vanished into memory, and someone with red-dyed hair and a protruding belly is sitting in slippers, typing away at a keyboard.
Artificial intelligence organizes all sorts of things for me.
Cyber Warfare Capabilities of Northeast Asian Powers — Conversation Summary
Prepared: August 14, 2026
1. North Korea
Capability Level
North Korea maintains a state-directed offensive cyber capability that is wildly disproportionate to its economic size. Under the Reconnaissance General Bureau (RGB), subordinate units such as Lazarus, Kimsuky, Andariel, and "Famous Chollima" operate, with total dedicated cyber personnel estimated at roughly 7,000.
Trellix's 2025 report: North Korean-affiliated groups accounted for 18.2% of all nation-state-aligned cyber activity detected in Q2–Q3 2025, making North Korea the single leading nation-state cyber threat.
North Korea was responsible for roughly 60% of global digital-asset (crypto) theft in 2025 (about $2 billion), rising to 76% in 2026.
CrowdStrike's 2026 report: "Famous Chollima" accounted for 47% of all state-backed hacking activity targeting the U.S. tech sector.
The World Cybercrime Index (UK/Australia/France academic consortium) ranked North Korea 7th globally, though critics argue this Western-expert-driven methodology likely underestimates the real threat.
Talent Pipeline and Training
Early talent-spotting: math/science prodigies are identified from elementary school and sent to Kumsong No. 1 and No. 2 middle schools for six years of intensive algorithm/programming training.
Formal higher education: Kim Il Sung University's Computer Science College, Kim Chaek University of Technology, and computer technology universities in Pyongyang and Hamhung.
Military-specialized institutions: Mirim University (now Kim Il Political-Military University), founded in 1986 on Kim Jong Il's orders, graduating roughly 100–110 cadres a year, and Moranbong University.
Overseas training: 50–60 top performers per year are sent to China or Russia for a year of training; high performers receive top-tier computers, food subsidies, and Pyongyang residency privileges.
Infrastructure workaround: because North Korea's domestic intranet (Kwangmyong) is closed off, operatives rely on border hubs such as Shenyang, China; a Russian fiber-optic link opened in 2017; and backdoors planted across Cambodia, Thailand, and Indonesia for staging.
Learning by doing: operatives infiltrate foreign companies via fake remote IT jobs, gaining hands-on exposure to real development and security environments — failure is met with another chance rather than punishment.
2. Japan
Japan has world-class technical infrastructure but has long been held back from converting it into operational cyber capability by its pacifist-constitution legal constraints.
SDF Cyber Defense Force: founded in 2014 with ~300 personnel, reorganized in 2022 to ~540, with a target of 1,000 under consideration — still far smaller than North Korea's dedicated force.
Active Cyber Defense Law (passed the Diet in May 2025): authorizes interception of foreign-origin traffic, mandatory incident reporting from critical infrastructure operators, and preemptive neutralization of attacker servers. Rollout is phased over 6 months to 2.5 years.
National Intelligence Council (NIC) / National Intelligence Bureau (NIB, ~730 staff): launched under the Prime Minister's office in July 2026 — Japan's first new intelligence agency since WWII — to consolidate intelligence previously scattered across police, the foreign ministry, and defense (an analytical control tower, not an operational attack/defense unit).
3. China
China ranks alongside the United States as a top-tier offensive cyber power.
April 2024 PLA reorganization: the Strategic Support Force (SSF) was dissolved and its cyber functions reorganized into a new "Information Support Force" reporting directly to the Central Military Commission; a separate Aerospace Force was also split off.
Forescout/Vedere Labs reporting: China has 210 identified nation-state-linked hacking groups — the largest in the world, roughly double Russia's 112 and quadruple Iran's 55 — and targeted 178 countries in 2025.
Strategic evolution: from "smash-and-grab" espionage toward long-term dormant pre-positioning inside critical infrastructure (Volt Typhoon, Salt Typhoon), widely assessed as preparation for contingencies such as a Taiwan conflict, increasingly combined with AI automation and supply-chain attacks.
4. Taiwan
Taiwan sits on the front line of China's cyber offensive, absorbing attacks in real time.
Taiwan's National Security Bureau: government/infrastructure targets faced an average of 2.63 million Chinese-origin cyberattacks per day in 2025 — double the 2023 level.
In July 2026, China-linked hackers deployed up to 8 autonomous AI agents simultaneously to attack 21 government systems — reportedly the first known instance of a state-level hack executed entirely autonomously by AI agents. Over 85 government accounts and 2,500+ personnel records were compromised, with the attack later extending to a nuclear safety regulator and 7+ energy companies.
Defense posture: Taiwan established a Ministry of Digital Affairs in 2022; its 2025–2028 cybersecurity budget totals about $300 million (~$75M/year), assessed as low relative to the threat. A hardware-centric industrial base has also left a shallow security talent pool.
International cooperation: the 2023 Taiwan Cybersecurity Resiliency Act with the U.S., and a 2025 information-security cooperation agreement with Paraguay.
5. South Korea — The NIS Cyber Control Tower Debate
A standalone "National Cybersecurity Basic Act," repeatedly introduced in 2013, 2016, and 2022, sought to give the National Intelligence Service (NIS) formal control-tower authority over national cybersecurity, but was blocked each time in the National Assembly over fears it would enable surveillance of private communications networks.
On May 7, 2026, the National Assembly Intelligence Committee passed an amendment to the NIS Act itself instead: it adds "economic security" to the NIS's mandate and expands its authority to investigate private companies whenever hacking is merely "suspected" to be the work of international or state-backed groups — achieving much of the same effect through a different legislative route rather than a standalone basic law.
Civil society groups (e.g., the NIS Watch Network) are raising the same objections as before: that this reverses domestic intelligence/covert-action powers curtailed in the 2020 NIS reform, that the vague "suspected" trigger invites abuse, that there is no independent oversight mechanism, and that no public consensus-building process took place. The bill has not yet passed the Judiciary Committee or a full floor vote.
6. South Korea's Own Cyber Warfare Capability (Comparative Assessment)
Cyber Operations Command: founded in 2010 with 400–500 personnel, now targeting a full strength of about 1,750; a service directly under the Ministry of National Defense and Joint Chiefs of Staff.
ITU Global Cybersecurity Index: rated top-tier (Tier 1) for defensive readiness and institutional maturity.
An earlier domestic assessment ranked Korea around 11th globally in actual cyber warfare capability, citing a lack of real-world offensive/response experience as the key weakness.
vs. North Korea: significantly behind in both scale and combat experience.
vs. Japan: currently ahead (earlier founding, larger force), but Japan is catching up quickly.
vs. China: simply not comparable in scale.
vs. Taiwan: both nations face an overwhelming adversary and are defense-postured, but Taiwan may have accumulated more real-world defensive experience given the sheer volume of attacks it absorbs daily.
References
Dailysecu, "North Korean hackers accounted for 76% of stolen crypto in 2026, hacking sophisticated by AI," https://www.dailysecu.com/news/articleView.html?idxno=206563
Cybersecurity Dive, "North Korea led the world in nation-state hacking in Q2 and Q3," https://www.cybersecuritydive.com/news/north-korea-hacking-trellix-report/803641/
TechCrunch, "North Koreans behind nearly half of US tech industry hacks, says CrowdStrike," https://techcrunch.com/2026/06/10/north-koreans-behind-nearly-half-of-us-tech-industry-hacks-says-crowdstrike/
NK PRO, "Study ranks North Korea seventh greatest cyber threat out of all countries," https://www.nknews.org/pro/study-ranks-north-korea-seventh-greatest-cyber-threat-out-of-all-countries/
GlobeNewswire, "CertiK Report: North Korean Hackers Behind 60% of Digital Asset Theft in 2025," https://www.globenewswire.com/news-release/2026/05/13/3294034/0/ko/
Kyunghyang Shinmun, "[North Korea TMI] The Secret of the 1%: How Are 'World's Strongest' North Korean Hackers Trained?," https://www.khan.co.kr/politics/north-korea/article/202107250800001
Munhwa Ilbo, "Mirim University Founded in 1986 on Kim Jong Il's Orders — Systematic Training of Cyber Warriors," https://www.munhwa.com/article/11255421
CSIS, "Hidden Enablers: Third Countries in North Korea's Cyber Playbook," https://www.csis.org/analysis/hidden-enablers-third-countries-north-koreas-cyber-playbook
Korea Daily, "Japan's Version of the CIA Emerges: National Intelligence Council and Bureau Officially Launched Under the PM," https://www.koreadaily.com/article/20260731003448439
Center for Cybersecurity Policy, "Japan's New Active Cyber Defense Law: A Strategic Evolution in National Cybersecurity," https://www.centerforcybersecuritypolicy.org/insights-and-research/japans-new-active-cyber-defense-law-a-strategic-evolution-in-national-cybersecurity
Hankuk-Japan Technology Information Center, Seoul National University, "A New Security Strategy: 'Active Cyber Defense'," https://hjtic.snu.ac.kr/node/13350
Japanese Wikipedia, "SDF Cyber Defense Force (自衛隊サイバー防衛隊)," https://ja.wikipedia.org/wiki/自衛隊サイバー防衛隊
Namuwiki, "PLA Strategic Support Force," https://namu.wiki/w/중국인민해방군%20전략지원부대
Daum News, "'China Has 210 Hacking Groups, World's No. 1'... Chinese Cyberattacks Intensify Further," https://v.daum.net/v/20260203161725638
Global Taiwan Institute, "China's Escalating Cyberattacks Threaten Taiwan's National Security," https://globaltaiwan.org/2026/08/chinas-cyberattacks-taiwans-national-security/
Newspim, "'China-Linked Hackers Use AI to Attack Taiwan... Nuclear Regulator Also Targeted'," https://www.newspim.com/news/view/20260812001082
Indo-Pacific Defense FORUM, "China's daily cyberattacks on Taiwan surpassed 2.6 million in 2025, report says," https://ipdefenseforum.com/2026/01/chinas-daily-cyberattacks-on-taiwan-surpassed-2-6-million-in-2025-report-says/
Asia Today, "Companies Don't Even Know They've Been Hacked… NIS Speeds Up Its 'Private-Sector Cyber Control Tower'," https://www.asiatoday.co.kr/kn/view.php?key=20260518010004942
Korea NGO News, "Civil Society Opposes NIS Act Amendment: 'Expands NIS Intelligence Activity and Covert-Action Powers'," https://www.ngonews.kr/news/articleView.html?idxno=230398
Dailysecu, "Will 'Suspicion' of State-Backed Hacking Alone Allow Investigation of Private Firms? NIS Act Amendment Controversy," https://www.dailysecu.com/news/articleView.html?idxno=206640
Namuwiki, "National Cybersecurity Center (국가사이버안보센터)," https://namu.wiki/w/국가사이버안보센터
Daum News, "The Growing Importance of 'Cyber Warfare': The Mission and Role of the Cyber Operations Command," https://v.daum.net/v/20250312060021106
Asia Today, "South Korea Ranks 11th Globally in Cyber Warfare Capability… Lacks Attack-Response Experience," https://www.asiatoday.co.kr/kn/view.php?key=20151202010001644
Korea.kr (Korean Policy Briefing), "South Korea Rated Top Tier 1 in the Global Cybersecurity Index," https://m.korea.kr/news/policyNewsView.do?newsId=148933962&pWise=mSub&pWiseSub=H13
