Digital Brinkmanship: North Korea’s Cyber Evolution and the Role of AI

This thesis investigates the evolution of North Korea’s cyber activities between 2009 and 2024, emphasizing the emerging role of artificial intelligence (AI) in cyber warfare. Motivated by the paradox of a resource-constrained and diplomatically isolated state wielding disproportionate cyber influence, the study employs a comprehensive, three-pronged methodological framework integrating: (1) a longitudinal timeline analysis, (2) in-depth qualitative case studies, and (3) a quantitative experiment leveraging a large language model (LLM) to document the evolution of North Korea’s cyber activities and the impact of AI on North Korea’s capabilities. First, I assembled and analyzed a large dataset of reliably attributed North Korean cyber incidents from 2009 onwards to identify macro-level patterns and strategic shifts in the regime’s cyber operations. Second, three pivotal case studies - the 2009 DDoS attacks, the 2014 Sony Hack, and the 2020 COVID campaign - were selected to represent distinct evolutionary stages of North Korea’s cyber activity. These case studies were systematically analyzed through four key lenses: attack methods, targets and objectives, international responses, and implications for international law (IL). This approach provides a holistic understanding of each facet of North Korean attacks by highlighting advancements in technical sophistication, examining deeper motivations behind the attacks, and evaluating the applicability of IL, specifically through the lens of the Tallinn Manual, to identify gaps and opportunities over time. Parallel to this, a quantitative component employs OpenAI 4.1 large language model (LLM) to measure whether AI-generated phishing attacks outperform human-generated phishing. Findings reveal a clear trajectory in North Korea’s cyber strategy over time, from initial rudimentary boundary-testing to increasingly sophisticated and coercive campaigns to financially motivated espionage. The quantitative analysis reveals the potential of AI to enhance the stealth and efficiency of phishing campaigns: AI-generated phishing attacks outperform human-generated emails by 14 percentage points. Ultimately, this thesis demonstrates how an increasingly emboldened North Korea and new AI-enabled tactics may change the global cybersecurity landscape, revealing the need for updated international legal frameworks, enhanced cyber education and defenses, and proactive policymaking to address the growing threat posed by North Korea’s AI-driven cyber operations.