NK hackers mainly steal secrets; SK sanctions WMD financiers; Iranian oil exports on the rise; IRISL brokering cargo deals
Prohibited Transactions for the week of 26 June 2023 (#10)
North Korea
The US government declassified an Intelligence Community (IC) assessment regarding the DPRK’s potential use of its nuclear arsenal through 2030. The IC finds that Pyongyang is “unlikely” to use nuclear weapons unless the “regime is in peril” and “probably will employ targeted diplomatic and covert actions” to raise tensions in pursuit of their goals.
A recent report on the DPRK’s cyber strategy reviewed 273 attributable North Korean cyberattacks occurring between July 2009 and May 2023, determining that 71.5 percent of the attacks were motivated by espionage and intelligence gathering. Financially motivated attacks made up approximately 20 percent of the identified cyberattacks. //There are two issues here: First, these percentages should be concerning to traditional financial institutions, decentralized finance (DeFi) companies and everyone in between. If accurate, it means the DPRK’s cybertheft of USD3 billion over the past five years wasn’t even the primary goal of Pyongyang’s cyber strategy. What would happen if 70 percent of North Korean cyberattacks were focused on stealing money? Second, are financial institutions, especially the big international ones, concerned about North Korean hackers stealing information — such as analytical reports or SARs/STRs — about DPRK illicit networks? North Korean bad actors can get a broad understanding of how exposed their illicit networks are by looking at which accounts get closed and what funds are frozen, but banks hold a lot more information that could be exploited by DPRK hackers.
North Korea reopened a remote border crossing with the PRC — between Musan in North Korea and Nanping in China — with freight trains already moving goods between the two sides. //The reopening could be tied to wanting to quietly transfer North Korean defectors held in China, or because of the desire to restart exports from the DPRK’s Musan mine to China.
A North Korean commentator hailed the call by BRICS nations — Brazil, Russia, India, China and South Africa — “to encourage domestic currency settlement in trade among member states and with friendly countries and actively promote the introduction of the common currency in accordance with it” and believes BRICS “is becoming a challenge to the existing international order and financial system led by the U.S. and the West.”
North Korea’s government is promoting domestic tourism as a means to raise foreign funds. When visiting tourist sites, payment is typically made in foreign currencies and officials realized that citizens were holding onto higher than expected amounts of hard currency. // Previous reports on the increase in domestic tourism to Pyongyang framed it as preparation for reopening of the border and welcoming of foreign tourists. The border opening talk continues, however, nothing appears concrete.
Seoul sanctioned a Russian citizen who was formerly a South Korean national, two companies — based in Mongolia and Russia — which he controlled, and a North Korean who works for the DPRK’s foreign trade bank in Russia. The four were sanctioned for raising funds on behalf of Pyongyang’s weapons of mass destruction (WMD) programs.
Iran
Iran’s oil minister acknowledged recent news reports which stated that Iran’s crude oil exports hit new highs in 2023 in spite of US sanctions, reaching 1.9 million barrels per day (bpd) in May 2023. In comparison, in 2018 before the US withdrawal from the JCPOA, exports were approximately 2.5 million bpd.
An Iranian official announced that the nation’s oil and gas sector attracted USD7.5 billion of foreign investment over the past two years. //This article also notes that during the Iranian president’s recent visit to the PRC, both countries “agreed to change the route for transiting Iranian products.” I haven’t seen this mentioned anywhere else in Iran’s English-language press, but am hoping more details are forthcoming.
Over the summer, the PRC may have a higher demand for Iranian oil, due to a drop in exports to China from Russia, as Moscow works to meet domestic demand.
Between 2018 and 2022, Tehran also earned USD61 billion from exporting 120 million tons of petrochemical products, which is Iran’s second largest source of revenue after crude oil.
Iran’s state run shipper, IRISL Group, has been brokering cargo transportation deals between the government and foreign shipping companies, as a means to evade Western sanctions.
Israeli authorities seized USD1.7 million in virtual currencies from Hezbollah and the IRGC-Quds Force. The funds were in wallets controlled by a Syria-based hawala operator, who was moving disbursements from the Quds Force to Hezbollah.
European Union (EU) diplomats indicated they will retain European sanctions on Iranian ballistic missiles, which otherwise would have expired in mid-October 2023.
Iranian officials confirm that Iraq’s USD2.7 billion gas debt to Tehran has been paid.