99 North Korea-Linked APT Issues in the First Half of 2026, South Korea Targeted 19 Times…AI and Deepfakes Also Used
In the first half of 2026, 158 issues involving APT activity attributed to North Korea, China, and Russia were reported, with North Korea accounting for the largest number at 99. South Korea was the most frequently targeted country by North Korea-linked groups, with 19 observed targeting instances. Activities involving fake recruitment, code repositories, npm packages, generative AI, and deepfakes were also repeatedly identified.
The information was verified as of 2026-08-16 Korea Standard Time.
What Exactly Does the Figure of 99 North Korean Hacking Issues Count?
The figure of 99 refers to the number of reported issues involving North Korea-linked APT groups analyzed by S2W from January 2026 through June. Because the original report specifically describes these as reported issues, the figure should not be interpreted as meaning that North Korea successfully compromised systems 99 times or that 99 hacking incidents caused damage within South Korea.
APT stands for Advanced Persistent Threat and refers to attack activity involving prolonged infiltration or attempts to obtain information from specific organizations or targets.
S2W recorded a total of 158 issues associated with North Korea, China, and Russia during the first half of the year. By country, the figures were 99 for North Korea, 33 for China, and 26 for Russia.
Reported issues involving North Korea increased by 12, from 87 in the second half of 2025 to 99 in the first half of 2026. The report stated that the increase was 13.8%.
The combined figure for all three countries rose from 147 to 158 over the same period, an increase of 11, or 7.5%.
Author's calculation: 99 North Korea-related issues ÷ 158 total issues × 100 = approximately 62.7%. In other words, more than approximately 6 out of every 10 issues involving the three countries covered by this report were associated with North Korean activity.
Why Does the Number of Attacks Targeting South Korea Stand Out?
Among countries targeted by North Korea-linked groups, South Korea ranked first with 19 observed targeting instances, followed by the United States with 8. For domestic users, the most important point is not simply that North Korea-related activity was widespread, but that South Korea was the most frequently observed target.
Comparing 19 with 8, South Korea recorded 11 more targeting instances than the United States. According to the author's calculation, South Korea was targeted approximately 2.38 times as often as the United States.
However, these figures do not represent the total number of hacking incidents in South Korea or the actual number of victims. They compare observed targeting instances by country among activities attributed to North Korea-linked groups in the S2W report.
Therefore, rather than saying that '19 North Korean hacking incidents caused damage in South Korea,' it is more accurate to state that 'South Korea was the most frequently observed target of North Korea-linked groups, with 19 targeting instances.' This interpretation remains within the scope of the original report.
How Were AI and Deepfakes Used?
The methods associated with North Korea-related activity in this report extended well beyond conventional email attacks. Activities targeting the cryptocurrency, IT, and software industries, as well as developers, repeatedly involved fake recruitment, code repositories, npm packages, generative AI, and deepfakes.
For attacks targeting developers in particular, it is difficult to limit security precautions to simply avoiding attachments from unknown senders. Code repositories and npm packages are resources routinely used in actual software development processes.
Generative AI and deepfakes were also explicitly identified in the report as elements used in North Korea-related activity. However, this finding should not be generalized to suggest that every attack attributed to North Korea used AI or deepfakes, which would go beyond the report's verified scope.
The first-half findings indicate that AI is being used alongside existing techniques such as social engineering, fabricated identities, and infiltration of development ecosystems, rather than necessarily constituting an entirely separate attack category.
Defending Against Attacks Requires More Than Watching for AI
Common attack techniques identified in activities attributed to North Korea, China, and Russia during the first half of 2026 included phishing, user execution, exploitation of vulnerabilities in publicly accessible servers, and abuse of proxy and cloud services.
Regarding vulnerabilities, 15 unique CVEs were identified a total of 19 times across activities attributed to the three countries. CVEs are publicly assigned identifiers for security vulnerabilities in software and systems.
The analysis also identified differences in country-specific patterns. North Korea-linked groups primarily relied on social engineering and direct execution by users. China-linked groups focused mainly on vulnerabilities in servers and perimeter devices, while Russia-linked groups primarily exploited vulnerabilities in documents, webmail, and network equipment.
Security measures therefore cannot be limited to identifying deepfake videos. This is why organizations must also examine email and messaging services, account authentication, development environments, publicly exposed servers and devices, and cloud infrastructure.
What Should Individual Users Check First?
For individuals, the most practical starting point is avoiding suspicious links and files and enabling 2-factor authentication on their accounts. In its phishing prevention guidance, the Korea Internet & Security Agency advises users not to visit websites with unclear origins or download or open unknown attachments.
Even when a message received through a messaging service or email contains a familiar company name, an acquaintance's name, or a job offer, it is safer not to immediately follow links within the message. Users should independently verify that the service is legitimate and access it through its official application or an address they enter directly.
Users should also configure additional authentication methods beyond usernames and passwords and keep their devices, antivirus software, and operating systems up to date.
Anyone who receives a phishing message or suspects a malware infection can use the Korea Internet & Security Agency's consultation and reporting service at 118, without an area code.
If account credentials have already been entered or a malicious file has been executed, users should check their accounts and devices for signs of compromise rather than simply deleting the message.
How Thoroughly Should Businesses and Development Teams Review Their Security?
According to the recommendations in the S2W report, businesses need a comprehensive security approach covering development environments, supply chains, internet-exposed assets, cloud services, and AI analysis environments, rather than focusing exclusively on stronger email filtering.
In particular, the appearance of fake recruitment, code repositories, and npm packages in North Korea-related activity highlights the need for development organizations to manage their accounts and software supply chains as distinct areas of security concern.
S2W recommended rotating credentials, investigating the scope of potential impact, and strengthening immutable backups and service recovery capabilities when an intrusion is suspected. Immutable backups are backups configured so that attackers cannot easily modify or delete them even after infiltrating a system.
Information and communications service providers that experience an actual security breach must also check their separate statutory reporting obligations. The current incident reporting guidance on the BohoNara security portal explains the categories of entities required to report an incident within 24 hours of becoming aware of it, along with the applicable procedures. It is important not to confuse an individual's suspicion of an incident with a business operator's legally mandated reporting obligations.
The Most Important Takeaways From These Figures
The findings for the first half of 2026 can be summarized in three key developments.
First, reported APT issues involving North Korea increased from 87 to 99, a rise of 13.8%.
Second, among the countries targeted by North Korea-linked groups, South Korea ranked first with 19 targeting instances, compared with 8 for the United States.
Third, attack activities combined traditional phishing and social engineering with fake recruitment, code repositories, npm packages, generative AI, and deepfakes.
Rather than remembering only that 'a new form of AI-powered hacking has emerged,' it is more useful for practical security preparedness to recognize that seemingly trustworthy people, recruitment offers, code, software packages, and messaging conversations can all become attack vectors.
Individuals can respond by avoiding links and files from unclear sources and enabling 2-factor authentication. Businesses and development organizations can strengthen their defenses by reviewing accounts, development environments, supply chains, cloud infrastructure, and backups together.
---