South Korean Legislative Election: Cyber Threat Considerations

The 2024 South Korean legislative election is scheduled for 10th April 2024 and will determine the constituent seats of the National Assembly of the Republic of Korea for the next four years.

The Quorum Cyber Threat Intelligence team has assessed that targeted cyber operations aligned with North Korea will likely escalate leading up to the legislative election. The National Election Commission’s (NEC) network will likely be targeted due to the potential for data exfiltration, as well as warnings from South Korea’s National Intelligence Service (NIS).

Additionally, with the increasing sophistication of artificial intelligence (AI) and deepfake technologies already having posed significant challenges for a number of democratic elections, South Korea will likely be no exception to this form of nefarious disinformation targeting that has the potential to undermine public trust and influence election outcomes.

North Korea’s vendetta against elections in the South

Pyongyang has historically launched a number of offensive efforts to influence the outcomes of South Korean elections. An example being when a former North Korean senior colonel from the Reconnaissance General Bureau, under the alias of ‘Kim Kuk Song’, disclosed details surrounding a cyber campaign during the 2012 South Korean presidential election. According to Kim, North Korean cyber units launched a covert propaganda operation to manipulate the public perception of conservative candidate Park Geun-hye and centrist Ahn Cheol-soo by posting critical comments on political news articles. The operation was likely aimed to sway South Korean voters toward candidates perceived to be favourable to North Korea and to magnify internal divisions within South Korea’s political domain.

This trajectory still exists, arguably in a more prominent manner, in 2024 with the NIS already issuing warning regarding the increased probability of disinformation being leveraged during election periods. An NIS official has already raised concerns North Korea-backed cyber actors have already leveraged AI to incite political unrest and confusion in South Korea as the election looms closer.

Recent Developments – 2024 Summit for Democracy

The impact of disinformation was the hot topic at the third iteration of the Summit for Democracy, which was hosted in South Korea’s capital, Seoul, on 20th March 2024. The South Korean President, Yoon Suk-yeol, voiced concerns surrounding detrimental impact of AI on the integrity of elections during the plenary session, emphasising the critical nature of this issue in global politics.

NEC vulnerable to North Korean cyber aggression

South Korea has a notoriously advanced digital infrastructure, which remains vulnerable to cyber threats, including those concerning its elections. In October 2023, a joint cyber security evaluation conducted by the NIS and the NEC revealed significant vulnerabilities within the Election Commission’s network infrastructure. South Korea’s Intelligence Service subsequently released warnings that the NEC’s network was vulnerable to attacks by North Korea-aligned cyber forces that could modify voter data and manipulate the election outcome. Critical areas of concern outlined by the NIS included the management of voter registers, ballot counting, and early voting systems.

With Pyongyang consistently demonstrating the Republic’s abilities within the cyber domain, involving highly sophisticated cyber-attacks and extensive disinformation efforts aimed at undermining the stability of political democracy, South Korea should do everything in its power to protect the election against the dual threats of North Korean cyber-attacks and disinformation campaigns within cyberspace.

Outlook

Given Seoul’s diplomatic ties with Western states, including the US and the UK, a successful compromise of the South Korean legislative election would likely extend beyond national boundaries and serve as a precursor for similar efforts against Western democracies, potentially destabilising electoral processes around the world.

South Korean defensive efforts within cyberspace will therefore serve not merely to protect its own democratic institutions but will also contribute to the defence of global democracy against the rising tide of cyber and informational threats.

For further details, you can refer to the Quorum Cyber Threat Intelligence Outlook 2024 report which provides a comprehensive breakdown on which offensive cyber operations will likely coincide with numerous major global events scheduled for 2024, such as presidential and national elections, as well as the Olympic Games in Paris.

Additionally, you can now sign up to the Quorum Cyber Global Cyber Threat Series: Far East webinar where we will provide our intelligence assessments surrounding the developing cyber threats within the Far East and how this will likely impact the threat landscape and businesses across the industry spectrum in areas of the world such as the UK and the US. We will also provide assessments regarding how cyber threats originating from this region will likely coincide with several high-profile global events scheduled for the remainder of 2024.