FireEye researchers identify North Korean hacking group APT38, which focuses almost exclusively on financial crimes and has tried to steal $1.1B so far
There is a distinct and aggressive group of hackers bent on financing the North Korean regime and responsible for millions of dollars …
Context & Ripple Effects
FireEye's naming of APT38 extends a house specialty: the firm did the same for China-linked espionage when it unveiled APT 30 in 2015, and it had already flagged Pyongyang's hackers as revenue-seekers in a 2017 report on attacks against South Korean crypto-currency exchanges. What is new here is the separation of motives — APT38 is carved out as a distinct unit that steals money rather than intelligence, with an attempted-take tally around $1.1B.
The distinction matters because it reframes North Korean cyber activity from disruption or espionage into a financing operation for the regime, a framing experts had been warning about since at least 2017.
First-order effects
- Banks, SWIFT-connected institutions and South Korean crypto exchanges now face a named adversary whose sole objective is theft, letting defenders prioritize fraud controls over espionage indicators.
- FireEye gains a differentiated threat-intelligence product: naming APT38 converts its research into sellable detection and response services for financial-sector clients.
Second-order effects
- Financial institutions and exchanges targeted by the group will be pushed toward shared threat intelligence and tighter transaction monitoring, since the attacker's goal is wire transfers and cryptocurrency rather than data.
- Rival security vendors must match FireEye's attribution work or cede the financial-crime threat-intelligence niche to it, just as governments weigh sanctions responses tied to named units.
Third-order effects
- If the pattern holds, state-sponsored hacking splits into two markets — espionage and direct revenue generation — forcing regulators and banks to treat nation-state actors as organized criminal enterprises rather than geopolitical noise.
- Sustained attribution by firms like FireEye builds the evidentiary record that later underpins coordinated government action against regime-financing cybercrime.
The trend: Nation-state hacking is bifurcating into espionage units and dedicated revenue-generating units, with commercial threat-intelligence firms like FireEye supplying the attribution that names them.