Summary of "The Rest Is Classified" - Episode 9: "North Korea’s CIA: Inside Kim’s Crime Family"

Release Date: January 1, 2025

In the inaugural episode of "The Rest Is Classified," hosts David McCloskey, a former CIA analyst and spy novelist, and Gordon Carrera, a veteran security correspondent, delve into the shadowy world of North Korean espionage. Titled "North Korea’s CIA: Inside Kim’s Crime Family," this episode uncovers the intricate mechanisms behind one of the most audacious cyber heists in history—the attempted robbery of the Central Bank of Bangladesh by North Korean operatives.

1. The Central Bank of Bangladesh Cyber Heist

The episode opens with a chilling recount of a spear phishing email sent to employees of the Central Bank of Bangladesh. Gordon Carrera recites the malicious message, designed to appear as a job application:

[01:13] Gordon Carrera: "I am Russell Alam. I'm extremely excited about the idea of becoming a part of your company..."

This email was a precursor to what would become the largest bank heist ever attempted. If successful, the operation would have marked one of history's most significant financial crimes.

2. North Korean Intelligence Services as Organized Crime

David McCloskey and Russell Alam discuss the unique nature of North Korea's intelligence operations, likening them to organized crime syndicates rather than traditional espionage agencies:

[02:07] Russell Alam: "It's a heist performed on the Central bank of Bangladesh by the North Korean security services... a story about security services... that effectively operate like the Mafia."

This comparison highlights the ruthless efficiency and criminal undertones of North Korea's intelligence activities, which prioritize financial gain to support the regime.

3. The Profile of Park Jin Hook

Central to the heist is Park Jin Hook, alleged to be one of the masterminds behind the Bangladesh bank robbery. However, North Korea denies his existence:

[04:39] Russell Alam: "But the North Koreans deny that anyone by that name even exists. And so, you know, he is sort of the shadowy face of the robbery."

Park's background is meticulously detailed, tracing his rise from a promising student to a key figure in North Korea's Reconnaissance General Bureau (RGB):

[05:13] David McCloskey: "He's born on August 15th of 1984... Growing up in this kind of totalitarian system..."

Park's exceptional mathematical abilities earned him a place at the elite Kimchaek University of Technology, a feeder institution for the RGB:

[13:05] David McCloskey: "He is probably spotted very young as being in the upper crust of his cohort in math."

4. Formation of the Reconnaissance General Bureau (RGB)

The RGB emerged from a reorganization of North Korea's intelligence services during the transition of power from Kim Jong Il to Kim Jong Un. Described as a "piratical organization," the RGB's aggressive tactics include high-profile assassinations and kidnappings:

[16:23] David McCloskey: "... the Enemy Collapse Sabotage Bureau, which at CIA we did not have anything bordering that name."

Gordon Carrera emphasizes the RGB's divergence from conventional spy agencies:

[16:36] Russell Alam: "It is very aggressive and its resume proves that."

5. North Korean Society and the Songbun System

The discussion shifts to North Korea's rigid social classification system, Songbun, which categorizes citizens based on loyalty to the regime. This system plays a pivotal role in Park's ascent within North Korean society:

[11:08] David McCloskey: "It's called songbun."

Russell Alam explains how this classification affects individuals' opportunities and standing:

[11:22] David McCloskey: "It's a system in North Korea that essentially sorts people into shades of loyalty..."

Park's elite education and positions within the RGB are seen as strategic moves to secure his and his family's standing within this hierarchy.

6. Technical Aspects of the Heist: Malware and SWIFT System

A significant portion of the episode delves into the technical intricacies of the Bangladesh bank heist. The North Korean operatives employed sophisticated malware such as Nest Egg and Sierra Charlie to gain and maintain access to the bank's systems:

[38:04] David McCloskey: "They're using something called Sierra Charlie to then hop from infected machines to more..."

Their ultimate goal was to infiltrate the SWIFT system (Society for Worldwide Interbank Financial Telecommunication), the global platform banks use to transfer funds:

[39:16] Gordon Carrera: "...the key is that they're going for something called SWIFT, which is the mechanism used for banks to move money internationally."

The meticulous planning spanned nearly a year, showcasing North Korea's patience and technical prowess:

[41:15] David McCloskey: "And so on Thursday 4th February, 2016, that groundwork is laid."

7. North Korea’s Cyber Operations and Global Impact

The episode broader explores North Korea's extensive cybercriminal activities, estimating that hacking may account for up to a third of the country's GDP. Operations include ransomware attacks, theft from cryptocurrency exchanges, and more:

[31:18] David McCloskey: "Maybe responsible for a third of North Korea's GDP."

The infamous Sony Pictures attack is highlighted as a politically motivated act, demonstrating the RGB's willingness to engage in high-stakes cyber warfare:

[33:08] Russell Alam: "Sony was releasing that film, The Interview... they hacked Sony Pictures and steal and release their emails."

8. Consequences and Conclusions

As the episode concludes, the hosts reflect on the audacity and scale of North Korea's cyber operations. Gordon Carrera likens the heist to a meticulously planned movie plot, emphasizing the strategic depth involved:

[36:03] David McCloskey: "This is an operation being run by the RGB... not a quick hack but a prolonged espionage effort."

The episode sets the stage for future discussions, teasing the unfolding of the heist and its ramifications on global cybersecurity.

Notable Quotes:

• Russell Alam [02:07]: "It's a heist performed on the Central bank of Bangladesh by the North Korean security services... a story about security services... that effectively operate like the Mafia."

• Gordon Carrera [27:10]: "We're back with the story of this amazing cyber heist... a boom town in a strange way."

• Russell Alam [34:30]: "They are going after banks from Vietnam to Mexico to Taiwan and Bangladesh."

Conclusion

Episode 9 of "The Rest Is Classified" provides an in-depth examination of North Korea's evolution into a formidable cyber power. Through the lens of the Central Bank of Bangladesh heist, listeners gain insight into the intricate blend of espionage, organized crime, and technological sophistication that defines North Korea's approach to securing resources for its regime. The hosts adeptly weave technical details with geopolitical context, offering a comprehensive overview suitable for both seasoned security enthusiasts and general audiences.