South Korea's national security agency stated on March 4 that since 2024, North Korean-backed cyber hackers have penetrated two South Korean semiconductor equipment companies, or to steal information on South Korea's domestic chip manufacturing projects. South Korea's National Intelligence Service said North Korea penetrated the servers of two companies in December 2023 and February 2024, stealing products from their facilities and blueprints of production facilities.
South Korea's National Intelligence Service said in a statement that the hackers adopted a technique called "living off the land (LOTL)" to minimize malicious code and use existing legitimate tools installed within the server, making it difficult to detect with security software, and recommended that South Korean companies take preventive measures.
The National Intelligence Service did not reveal details about the hacking groups or targets, saying only that the criminals were focusing on servers connected to the Internet. The agency added that North Korea may have begun preparations to produce its own semiconductors as sanctions make it difficult for the country to procure chips.
North Korea may begin to focus its cyber attacks on the chip field from the second half of 2023 to meet greater needs for satellite and missile research and development.
North Korea has always denied involvement in cybercrime, although it has been blamed for cyberattacks that caused millions of dollars in damage.