Cyberattacks on South Korea military reached their highest level in five years in 2025, highlighting growing cybersecurity risks as the Ministry of National Defense struggles to retain trained cyber specialists. The rise in attacks, coupled with phishing emails and concerns over North Korea’s expanding cyber capabilities, has intensified calls for stronger defense measures.
According to data submitted by the Ministry of National Defense to Rep. Yu Yong-weon of the main opposition People Power Party and a member of the National Assembly’s National Defense Committee, cyberattacks on South Korea military systems declined from 11,700 cases in 2021 to 9,115 in 2022 before increasing to 13,599 in 2023 and 14,419 in 2024.
Last year, the number surged to 18,951, representing a 108 percent increase from 2022 and a 31 percent rise compared with 2024, making it the highest annual total in the past five years.
Cyberattacks on South Korea Military
Most cyberattacks on South Korea military networks involved attempts to gain administrator privileges and compromise military websites, accounting for 18,792 incidents in 2025. Meanwhile, phishing emails disguised as messages from trusted senders rose sharply from just 16 cases in 2023 to 127 last year, indicating that cyberattack methods have become increasingly diverse.
“Recent signs indicate that North Korea has begun using AI in its hacking operations, including malware development and attempts to infiltrate organizations through fake job applications, which allude to its cyber capabilities’ increasing sophistication,” the Cyber Operations Command said in materials submitted to Yu’s office.
The concerns come as North Korea is expected to strengthen cyber operations by expanding its Reconnaissance General Bureau, while South Korea’s Defense Counterintelligence Command has been effectively dismantled.
Ministry of National Defense Faces Cyber Workforce Challenges
Despite rising cyberattacks on South Korea military infrastructure, the Ministry of National Defense continues to face difficulties retaining cybersecurity personnel. Since 2012, the ministry has operated a cyber officer cadet program that provides approximately 40 million won (US$26,700) in tuition support to students in designated university departments.
Graduates are commissioned as officers and assigned to units including the Cyber Operations Command and the 777 Command, where they conduct cyber threat analysis, cybersecurity operations, and digital forensics.
However, data obtained by Yu’s office shows that 89 of the 104 cyber specialist officers commissioned between 2016 and 2019—around 85 percent—left in the military after completing their mandatory seven-year service. Last year, only seven of 24 graduates accepted commissions.
Although those declining military service members must repay their financial assistance, some have chosen that option instead, largely due to stronger demand, higher salaries, and better working conditions in the private AI and cybersecurity sectors.
Growing North Korean Cyber Threat
North Korean leader Kim Jong-un recently ordered the expansion of the Reconnaissance General Bureau, the country’s primary intelligence agency responsible for overseas intelligence gathering, operations targeting South Korea, and cyber activities. During an expanded meeting of the Central Military Commission of the ruling Workers’ Party, reported by the state-run Rodong Sinmun, officials proposed expanding the bureau’s responsibilities and strengthening its reconnaissance and intelligence capabilities.
Created by reorganizing the former Reconnaissance Bureau under the Korean People’s Army General Staff, the agency is believed by South Korean military intelligence to oversee around 8,400 hackers. Analysts expect that number to increase following Kim’s directive.
“At a time when North Korea is rapidly advancing its cyberattack capabilities, we cannot allow a system in which cyber specialists simply leave the military after fulfilling their mandatory service,” Rep. Yu said. “We need a systematic personnel management system that covers the recruitment, training and long-term retention of cyber experts.”
