CET1iin

CET1iin is a North Korean hacking group allegedly associated with the North Korean government, often referred to as "Group 123.

CET1iin has been involved in various cyber attacks targeting the information technology and communication sectors in South Korea since its first reported incident in 2017. The group's activities are believed to be sponsored by the Reconnaissance General Bureau of the Korean People's Army's General Staff, which conducts intelligence operations and cyber warfare.

CET1iin's attacks typically involve deploying malware and distributed denial-of-service (DDoS) attacks on government and private sector targets. The group has been linked to several high-profile attacks, including malware targeting the South Korean Air Force Military Development and Mobilization Command and South Korea's media outlets.

From 2017 to 2020, CET1iin carried out several more notable operations against South Korean organizations. The group attacked several healthcare facilities, infecting thousands of computers and stealing tens of thousands of records containing sensitive patient data. CET1iin also targeted smaller institutions such as local banks and credit card providers.

North Korea's growing interest in cyber warfare, observed in the last decade, appears to be partly due to economic necessity, alternative exploitation of the country's labor costs, as well as exploration of the value of unleashing nation-state-scale digital intensity against their perceived adversaries. CET1iin's explicit involvement in various hacking incidents indicates that North Korea's largely agricultural economy is turned towards having nation-state-level cyber capabilities for gains directly influencing international relations, economic viability, and peacetime operations not confined to the immediacy of the operational title.