Russia, North Korea partner on cybercrime, researchers warn – politico.eu

Report on Alleged Cyber-Cooperation Between Russian and North Korean Entities and its Implications for Sustainable Development Goals

Executive Summary

Recent analysis indicates a potential operational partnership between the Russian-linked Gamaredon cyber group and the North Korean Lazarus group. This collaboration, evidenced by shared malware infrastructure, represents a significant threat to international security and undermines progress towards several key Sustainable Development Goals (SDGs), most notably SDG 16 (Peace, Justice and Strong Institutions).

Analysis of Cyber-Activities and Impact on SDG 16

The observed coordination between the two state-sponsored hacking groups directly contravenes the principles of SDG 16, which aims to promote peaceful and inclusive societies, provide access to justice for all, and build effective, accountable, and inclusive institutions at all levels.

• Shared Infrastructure: Analysts discovered that a server controlling Gamaredon malware was also being utilized by the Lazarus group. Furthermore, a Gamaredon-run server was found hosting malware characteristic of Lazarus’s tools.
• Undermining Peace and Justice (Target 16.1): This cooperation supports aggressive cyber operations targeting government networks, particularly in conflict zones like Ukraine, thereby escalating hostilities and directly opposing the goal of reducing all forms of violence.
• Weakening Institutions (Target 16.a): The primary objective of Gamaredon’s attacks on Ukrainian government networks is intelligence collection, an act that weakens national institutions and compromises state security, hindering their ability to function effectively.

Illicit Financial Flows and Economic Disruption (SDG 16 & SDG 8)

The methods employed by the Lazarus group, which may now be shared with or studied by Gamaredon, have direct implications for global financial stability and economic growth, challenging SDG 16.4 (reduce illicit financial flows) and SDG 8 (Decent Work and Economic Growth).

• Illicit Revenue Generation (Target 16.4): The Lazarus group is known for conducting financially motivated cybercrime, including the theft of cryptocurrency. This activity constitutes a significant illicit financial flow, providing revenue to a heavily sanctioned state and perpetuating a cycle of instability.
• Threats to Economic Growth (SDG 8): The use of deceptive tactics, such as fake job offers, to infiltrate systems and steal assets disrupts legitimate economic activities and undermines trust in digital infrastructure, which is crucial for sustainable economic growth.

Escalating Geopolitical Cooperation and Opposition to SDG 17

The cyber-cooperation is part of a broader trend of increased partnership between Moscow and Pyongyang, which stands in stark opposition to SDG 17 (Partnerships for the Goals), which calls for global cooperation to achieve sustainable development. This alliance actively works against global peace and security.

1. Military Support: Reports indicate that thousands of North Korean soldiers have been sent to Russia to support its war efforts in Ukraine.
2. Drone Operations: Ukrainian authorities have reported that North Korean troops are involved in flying reconnaissance drones across the border.
3. Arms Manufacturing: Ukrainian military intelligence suggests that North Korea plans to send thousands of workers to Russia for the purpose of manufacturing drones.

Analysis of SDGs in the Article

1. Which SDGs are addressed or connected to the issues highlighted in the article?

• SDG 16: Peace, Justice and Strong Institutions

  This is the most relevant SDG. The article directly discusses threats to peace and security through the military cooperation between Russia and North Korea in the war against Ukraine. It also highlights threats to justice and institutions through the coordinated cybercrime and espionage activities of state-sponsored groups (Gamaredon and Lazarus), which undermine government networks and engage in illicit financial flows like cryptocurrency theft.

• SDG 17: Partnerships for the Goals

  The article discusses a partnership between Russia and North Korea. However, this partnership is shown to be destructive, working against the principles of global peace and security that underpin the SDGs. It represents a negative example of international cooperation, where technology, military support, and personnel are shared to fuel conflict and conduct cybercrime, directly opposing the goal of fostering constructive partnerships for sustainable development.

• SDG 8: Decent Work and Economic Growth

  This SDG is connected through the mention that “North Korea would send thousands of workers to Russia to manufacture drones.” The context of North Korean overseas labor, often linked to exploitative conditions, raises concerns about decent work, labor rights, and potential forced labor, which are central themes of SDG 8.

2. What specific targets under those SDGs can be identified based on the article’s content?

1. Target 16.1: Significantly reduce all forms of violence and related death rates everywhere.

   The article’s focus on the war in Ukraine, supported by North Korea sending “thousands of North Korean soldiers to Russia” and flying “drones across the border,” directly relates to the perpetuation of violence and conflict, which this target aims to reduce.

2. Target 16.4: By 2030, significantly reduce illicit financial and arms flows, strengthen the recovery and return of stolen assets and combat all forms of organized crime.

   This target is addressed by the activities of the Lazarus group, which is known for “stealing cryptocurrency, a key revenue source for North Korea.” This constitutes an illicit financial flow. The coordinated cyber activities between Gamaredon and Lazarus can be seen as a form of transnational organized crime.

3. Target 16.a: Strengthen relevant national institutions, including through international cooperation, for building capacity at all levels… to prevent violence and combat… crime.

   The article highlights the antithesis of this target. The cooperation between Russia and North Korea is not to prevent violence or crime, but to perpetrate it through military support and coordinated cyberattacks. This undermines, rather than strengthens, institutions and global security.

4. Target 8.8: Protect labour rights and promote safe and secure working environments for all workers, including migrant workers…

   The plan for North Korea to “send thousands of workers to Russia to manufacture drones” implicates this target. Given the history of conditions for North Korean overseas laborers, this raises significant concerns about the protection of their labor rights and the safety of their working environment, especially in a country at war.

5. Target 17.16: Enhance the global partnership for sustainable development…

   The partnership described between Moscow and Pyongyang is a direct counterpoint to the spirit of this target. Instead of a partnership for development, it is a partnership that fuels conflict and cybercrime, thereby undermining global stability and the foundations required for sustainable development.

3. Are there any indicators mentioned or implied in the article that can be used to measure progress towards the identified targets?

1. Implied Indicator for Target 16.4 (Illicit Financial Flows):

   The article mentions that stolen cryptocurrency is a “key revenue source for North Korea.” This implies that the volume and value of stolen digital assets can serve as an indicator to measure the scale of illicit financial flows conducted by state-sponsored groups.

2. Implied Indicators for Target 16.1 (Violence and Conflict):

   The article provides quantifiable, albeit not precise, data points that can be used as indicators of conflict escalation. These include the number of foreign troops involved in a conflict (“thousands of North Korean soldiers”) and the use of specific military technologies (“North Korean troops were flying drones”).

3. Implied Indicator for Target 8.8 (Migrant Workers):

   The mention that “North Korea would send thousands of workers to Russia” points to the number of migrant workers deployed to conflict zones or high-risk environments as a potential indicator for assessing risks to labor rights and safe working conditions.

4. Implied Indicator for Target 16.a/17.16 (Destructive Partnerships):

   The article’s central theme of a “new level of coordination between Moscow and Pyongyang” in cyber and military affairs suggests that the existence and scope of international agreements or collaborations that undermine global peace and security norms can serve as a negative indicator, measuring actions that run counter to the goals of strengthening institutions and fostering positive partnerships.

SDGs, Targets, and Indicators Analysis

Source: politico.eu