On October 1, the European Union Company for Cybersecurity (ENISA) printed its annual Menace Panorama 2025 report, outlining “probably the most outstanding cybersecurity threats and developments the EU faces within the present cyber risk ecosystem.”
An examination of probably the most outstanding state-aligned cyber threats confronted by the EU revealed, unsurprisingly, that Russia and China have been probably the most lively in focusing on Union members over the reporting interval (July 1, 2024 – June 30, 2025). Each sectoral and geographic focusing on by hackers from these nations gave the impression to be aimed toward attaining their sponsoring nation-state’s grand geopolitical ambitions, akin to Russia’s ongoing battle in Ukraine or China’s financial ambitions outlined in its Made in China 2025 (MiC25) or China Normal 2035 insurance policies.
Nonetheless, opposite to widespread notion, ENISA listed North Korean state-aligned cyber intrusions because the third most noteworthy risk to EU members, rating them above extra researched risk actors, akin to Iran. ENISA’s findings additional underscore the rising multipronged risk that North Korea poses to the West and the necessity for European policymakers to strategy Pyongyang from a holistic strategy, past a deal with its kinetic navy exercise vis-à-vis Russia.
When ENISA’s North Korea-related findings are examined extra carefully, it turns into obvious that the geopolitical motivations behind its cyberattacks carefully align with international developments. Certainly, North Korean state-aligned cyber operations may be categorized primarily into two distinct, however at instances overlapping, sorts: financially motivated or cyber espionage campaigns.
Cyber Theft as an Financial Lifeline
Indicative of the primary class, ENISA said that the “DPRK [Democratic People’s Republic of Korea]-nexus exercise is closely skewed in the direction of EU personal corporations, with a deal with human assets, monetary companies (together with crypto) and expertise.” North Korea has been experiencing a pointy socioeconomic decline during the last decade. This decline is primarily because of the persistent long-term results of worldwide sanctions, in addition to the shorter-term impacts of COVID-19-related border closures on Pyongyang’s commerce with key financial companions, akin to China and Russia.
North Korea’s latest enhance in exports of arms, ammunition, provides, and personnel to Russia for its conflict in Ukraine has offered an financial boon for Kim Jong Un’s regime. Nonetheless, North Korea stays a cash-strapped nation, with the aforementioned inhibiting components forcing it to assemble much-needed funds via extra illicit means, together with cyberattacks in opposition to monetary establishments and cryptocurrency exchanges.
In response to a July 2025 report printed by cryptocurrency evaluation agency Chainalysis, North Korean hackers stole over $2.17 billion price of cryptocurrency from cryptocurrency companies within the first half of 2025. Chainalysis’s report discovered that nations sometimes focused by Pyongyang, such because the U.S., Japan, and South Korea, had probably the most vital focus of funds stolen globally. Nonetheless, each ENISA and Chainalysis additionally famous that EU nations, akin to Germany, additionally represented high-priority targets for hackers linked to Pyongyang.
Cyber Intelligence Operations Gathering in Europe
When inspecting the opposite class, the most typical type of North Korean cyber espionage that poses a major risk to the Union’s safety was Pyongyang’s IT job-themed schemes. In response to ENISA, North Korean hacking teams Lazarus and Well-known Chollima have been noticed focusing on “EU entities” concerned within the protection, aerospace, media, well being, vitality, and government-related sectors.
Whereas the ENISA report didn’t clarify why these industries have been focused, there’s a medium-to-high chance that North Korean hackers sought to achieve strategic insights into ongoing protection build-up efforts from EU and NATO members, together with their rising partnership with South Korea. For instance, the European Fee introduced in March 2025 its ReArm Europe Plan/Readiness 2030 objective, which proposes to “leverage 800 billion euros” to assist EU states enhance their protection capabilities. Equally, the NATO members agreed throughout their 2025 summit in The Hague to extend their protection spending to five %. This enhance will comprise at the very least 3.5 % for core protection necessities and 1.5 % to reinforce the alliance’s important infrastructure resiliency/preparedness.
This protection build-up would require a major enhance within the EU’s present protection complicated’s manufacturing output, one thing that’s unlikely to occur with out exterior partnerships. For instance, in August 2025, the South Korean authorities finalized a $6.5 million take care of the Polish authorities to provide K2 Black Panther tanks for the Polish navy. As part of this deal, Seoul agreed to expertise transfers and native manufacturing licensing, guaranteeing that South Korean protection companies switch manufacturing, meeting, and MRO (upkeep, restore, and overhaul) applied sciences to Warsaw to assist construct up its home manufacturing capabilities.
Whereas such partnerships will help EU and NATO members in attaining their brief and long-term industrialization objectives, in addition they develop the digital vectors via which North Korean hackers might goal EU protection companies and expertise. Extra particularly, EU protection companies’ renewed defense-related efforts and exterior partnerships are prone to necessitate a rise in IT-related employees to handle the onboarding of recent personnel and workflows, in addition to increasing manufacturing profiles and R&D with companion organizations. It’s within the chaos of this speedy enlargement that North Korean hacking teams, akin to Lazarus, are prone to exploit to achieve entry to important protection infrastructure.
There are already early indicators that such targets could possibly be inside Pyongyang’s geopolitical agenda. For instance, on April 1, Google’s Menace Intelligence Group (GTIG) printed a report on North Korea’s utilization of faux IT employees to focus on European companies. Herein, GTIG claimed that at the very least 12 North Korean-operated personas have been actively in search of employment in a number of European protection and authorities sector entities. As such, North Korean hacking teams, akin to Lazarus, specializing in cyber espionage, could possibly be utilized to assemble intelligence on the rearmament progress of EU-NATO members, together with the kind of protection tools they’re producing, the portions, the place it’s being shipped to or stationed, and their capabilities.
North Korea’s Rising Cybercrime Alliance With Russian Ransomware Gangs
In live performance, one other situation is that North Korean hackers might promote entry to the compromised Europe-based protection companies and authorities establishments to cybercriminal organizations. The credibility of such a situation is elevated when Pyongyang’s deepening relationship with Russian cybercriminal organizations is taken into account. For instance, a 2024 report by cybersecurity agency Palo Alto Networks’ Unit42 discovered that North Korean cyber actors have been collaborating with the Play ransomware gang.
The rationale of such a collaboration would probably be two-fold. First, it might help Pyongyang in producing income for the Kim regime and its nuclear weapons program. Such preliminary entry would probably solely be offered after North Korean hackers had extracted all of the R&D and government-related info they wanted to reinforce their very own protection manufacturing capabilities and help their very own geopolitical ambitions and people of their allies.
Second, this Pyongyang-ransomware collaboration would serve to disrupt Europe’s protection complicated earlier than it could actually pose a critical risk to North Korea’s sovereignty and geopolitical ambitions. Certainly, North Korea’s cybercriminal companions are extremely prone to exploit their paid-for entry to launch disruptive and/or damaging cyberattacks, akin to ransomware or wiper malware. Such assaults would encrypt these companies’ programs and extort monetary compensation from them.
With the common downtime from ransomware being solely 24 days, the long-term affect on Europe’s general protection resiliency is prone to be restricted to reasonable. However, such short-term disruptions might affect the EU or NATO’s capability to reply sporadically and quickly to sudden threats, akin to an invasion, if the cyberattack is timed in live performance with a kinetic operation. Nation-states, akin to Russia, have demonstrated expertise with this sort of coordination throughout the early stage of the Ukraine battle. Subsequently, it’s on this regard that they may coordinate carefully with much less skilled companions, akin to North Korea, to assist them achieve real-life expertise with hybrid warfare ways.
North Korea’s Cyber Profile Adjustments the Complexity of the Ukraine Battle
Additional afield, the potential implications of such North Korea-enabled cyberattacks might show not solely detrimental for the EU and NATO’s resiliency efforts but in addition for nations it helps, akin to Ukraine. Within the case of European protection companies aiding the Ukrainian navy, unfettered North Korean entry to those digital networks might enable them to cross important info, akin to provide chain routes or important vulnerabilities, on to Russian forces. This info would then be used to hold out focused artillery or missile strikes in opposition to key weapons consignments and/or disrupt Ukrainian provide chains. Such a situation threatens to deal a major blow to Kyiv’s defensive place vis-à-vis Russia, enabling a extra unrestrained Russian offensive within the Donbas area and past.
Conclusion: It’s Time to Construct a Holistic Method Towards North Korea
The findings outlined within the ENISA Menace Panorama 2025 report display that North Korea’s cyber actions are not a peripheral concern however a central element of its broader geopolitical technique. North Korea’s potential to infiltrate important industries and form the result of regional conflicts highlights a urgent want for the EU and NATO to take a extra holistic strategy towards cyber resilience, industrial safety, and provide chain safety.
Certainly, the EU and NATO have to refocus their strategy towards North Korea to make sure that they not deal with it as merely a rogue nation in a far-off area. As an alternative, it must be considered as a present, not rising, risk, whose affect extends far past the Korean Peninsula.
