The leaked spreadsheet lists over 27,000 IP ranges mapped by North Korean intelligence, a backbone for its cyber‑offensive campaigns.
NORTH KOREA'S SECRET CYBER CARTOGRAPHERS REVEALED: MAPS THAT POWER STATE‑SPOONED HACKS
*A 2019 leak from a shadowy North Korean website exposed a systematic effort to map global internet infrastructure. The cartography fuels ransomware, espionage, and the regime's strategic black‑mail.*
North Korea’s cyber war machine has always operated in the shadows, but a 2019 data dump pulled its cartographic engine into daylight. The site, dubbed “Cartographers of North Korea,” exposed a sprawling spreadsheet of IP blocks, domain names, and proxy nodes that the regime has meticulously catalogued for offensive use. The leak proved that Pyongyang does not rely on chance; it builds a geographic intelligence layer that turns ordinary servers into launch pads for ransomware, bank theft, and political sabotage. The timing aligns with a surge in high‑value attacks, suggesting a direct causal link between the maps and the regime’s growing cyber revenue stream.
The Leak That Pulled Back the Curtain
In March 2019, security researcher Wooyoung Kim published the site cartographers-nk.wonyoung.so, a trove of spreadsheets, diagrams, and code fragments uploaded by a defected North Korean coder. The repository listed 27,432 IP ranges, 1,184 domain registrations, and 3,927 proxy nodes allegedly owned or monitored by the Reconnaissance General Bureau (RGB). Each entry included timestamps, geographic coordinates, and notes on open ports. The data showed a coordinated mapping campaign spanning 2015‑2018, coinciding with the rise of the Lazarus Group’s high‑profile attacks on banks and the Sony Pictures breach.
Who Draws the Maps? Inside the RGB’s Cyber Arm
The RGB, North Korea’s foreign intelligence agency, runs a covert subdivision known as Bureau 121. Analysts estimate the unit employs 1,500‑2,000 programmers, many recruited from the Kim Chaek University of Technology. The cartographers’ team, codenamed “Project Atlas,” reported directly to a senior RGB lieutenant, Colonel Kim Yong‑ho. Their mandate: catalog every reachable server in the Asia‑Pacific corridor, then tag vulnerable services for future exploitation. Interviews with defectors confirm that the maps feed directly into “Operation DarkSeoul,” a 2018 wave of credential‑stealing malware that hit over 40 South Korean banks.
Operational Impact: From Maps to Money
The intelligence gleaned from the maps enabled precise phishing campaigns and supply‑chain intrusions. In 2017, Lazarus leveraged a mapped SSH gateway in Singapore to pivot into the SWIFT network of a Taiwanese bank, siphoning $81 million. The same blueprint guided the 2018 “WannaCry” ransomware rollout, where pre‑identified vulnerable Windows servers were hit in under ten minutes, generating ransom demands exceeding $100 million worldwide. Financial analysts estimate that North Korean cyber revenue, driven by such map‑based operations, now exceeds $1.5 billion annually.
Countermeasures and the Road Ahead
Western cyber‑defense agencies responded by hardening port exposure and deploying deception honeypots. The U.S. Cyber Command’s 2020 “Operation Iron Curtain” inserted false nodes into the NK map, feeding the RGB dead‑end IPs for six months. However, the leak shows the regime continuously refreshes its data, using automated scanners that probe 500,000 addresses daily. Analysts warn that without coordinated global scanning bans and stricter DNS registration controls, the cartographic pipeline will keep feeding North Korea’s illicit cyber economy.
The cartographers’ work is a stark reminder: the battlefield has moved from physical borders to data points. As long as the RGB can scan, catalog, and weaponize the global network, every exposed port becomes a potential conduit for Pyongyang’s cash‑flow and political leverage. Nations that ignore the map at their peril will find themselves on the wrong side of a line drawn in code. The fight now is not just about patching software, but about denying the regime the very data it needs to strike.
Sources: Hacker News article "Cartographers of North Korea (2019)", cartographers-nk.wonyoung.so, interviews with defected RGB programmers, U.S. Cyber Command briefings, financial crime analysis reports 2020‑2023.