CPT Heo Jeongin is a Republic of Korea Army officer currently attending the Captain’s Career Course (CCC) at the U.S. Army Intelligence School (Fort Huachuca) and wrote the following assessment as part of the Forging Leadership Program. Divergent Options’ content does not contain information of an official nature, nor does the content represent the official position of any government, any organization, or any group.
Title: Assessment of North Korea’s Attempts to Destabilize South Korea
Date Originally Written: June 30, 2025
Date Originally Published: July 29, 2025
Author and / or Article Point of View: The author is a South Korean military officer participating in the Captain’s Career Course at the U.S. Army’s Intelligence School (Fort Huachuca) as part of the FMS program. The author supports the ROK-U.S. Mutual Defense Treaty and the ROK-U.S. alliance. This article is written from the perspective of South Korea regarding North Korea.
Summary: North Korea’s espionage activities in South Korea have continued into the 2020s. These efforts now focus on creating sympathizers within South Korea to utilize them as agents, rather than directly infiltrating. It is crucial for South Korean citizens to remain vigilant against these security threats and take an active role in protecting their society and nation from such dangers.
Text: Since 2021, individuals acting as North Korean spies have been arrested, detained, and brought to trial in South Korea. Investigations conducted by the National Intelligence Service and prosecutors revealed that these spies were operating across various regions in the country and were connected through organized networks. Authorities have carried out arrests in major cities such as Cheongju, Jeju, and Changwon, with some cases still undergoing trials while others have already resulted in confirmed sentences [1], [2]. The authorities have discovered that former and current executives of one of South Korea’s prominent labor organizations, the Korean Confederation of Trade Unions, were also recruited by North Korea to engage in espionage activities. These individuals are currently appealing their confirmed sentences and are undergoing further legal proceedings [3]. The court has judged these individuals guilty of espionage and of violating the National Security Act, imposing punishments accordingly. While many spies identified during investigations into previous spy rings have been apprehended, the lack of sufficient evidence to imprison or punish them legally has led to instances where they are not penalized or are acquitted. Additionally, ongoing political conflicts persist over whether the National Intelligence Service (NIS) should retain counterespionage investigative authority or transfer it to the police. The extent of investigations and punishments for such espionage activities also tends to be influenced by the ruling party’s approach to addressing issues with North Korea.
North Korea’s operations targeting South Korea have long been part of its strategy to induce internal division and destabilize the system, ultimately aiming for a North Korea-led unification and the communist control of the Korean Peninsula. As a key communist tactic, the united front strategy continues to be actively employed by North Korea to this day. By recruiting sympathetic forces within South Korea, such as progressive left-wing groups, religious organizations, civic groups, and media entities, North Korea seeks to maximize internal discord and bolster propaganda in favor of its regime. In early 2024, Kim Jong-un redefined North and South Korea as two hostile nations, abolishing or renaming existing South-targeted organizations. During this process, the Cultural Bureau, responsible for operations against the South, was expanded into the Bureau of Cultural Exchange to strengthen its activities [4]. Given the increased difficulty of physically infiltrating the South due to tightened border security and surveillance, since the 2000s, direct espionage efforts from North Korea to South Korea have been restricted. North Korea has adopted alternative strategies such as disguising agents as defectors or recruiting South Koreans from third countries like China and Cambodia to use them as spies. Additionally, leveraging the legal limitations of South Korea’s National Security Act—which only punishes individuals directly linked to North Korea—North Korea has employed agents of third-country nationality to evade detection. These operatives have infiltrated various spheres, including political parties, civic organizations, and labor unions, actively or covertly working to support North Korea’s agenda within South Korea.
The operatives’ primary activities involved infiltrating various organizations across South Korean society to expand their influence and recruiting key figures. These operations ranged from gathering military information on U.S. Forces Korea bases, troop movements, and counterintelligence vulnerabilities to reporting such findings under the directives of North Korea’s Bureau of Cultural Exchange. The authorities confirmed that instructions were received through encrypted messengers or USB devices. Their activities were not limited to intelligence gathering—they also focused on shaping pro-North Korean public opinion within South Korea and presenting it as the dominant sentiment. Traditional methods of agitation included weekly protests demanding the termination of ROK-U.S. joint military exercises, the withdrawal of U.S. Forces Korea, the resignation of conservative administrations, and the abolition of the National Security Act.
What poses an even greater threat than physical gatherings or protests is the organized activities conducted within online spaces. These efforts manipulate public opinion to make their claims appear as if they represent the majority sentiment of the population. Not only have conservative politicians and parties been targeted, but lawsuits, complaints, and comment manipulation have also been used to disrupt the activities of media outlets and individual YouTubers [5]. Such public opinion manipulation even extends to democratic elections, influencing outcomes to benefit their agenda. South Korea’s current state of division—fueled by generational, gender, and regional conflicts—creates a favorable environment for these operations. North Korean infiltrators within South Korea have exacerbated political factionalism and sowed distrust between the government and the public [6]. These efforts aim to weaken national security awareness and dismantle psychological defenses. Propaganda, agitation, and the spread of false information are conducted easily, but correcting misinformation and restoring facts require significant time and resources. This imbalance increases social costs and intensifies unnecessary disputes, further amplifying conflicts. North Korea’s espionage activities have inflicted substantial damage on South Korea, both socially and in terms of national security.
In response to North Korea’s espionage activities, South Korea has been strengthening counterintelligence efforts through the National Intelligence Service and the National Police Agency. Despite ongoing debates about the existence and application of the National Security Act, lawmakers and officials are making efforts to amend it to expand its scope beyond North Korea to include all entities threatening South Korea’s security.[7] Additionally, in November 2024, authorities reaffirmed that the ROK-U.S. Mutual Defense Treaty extends to cyber and space domains, signaling potential cooperation in countering espionage activities in the cyber realm.
However, the most critical factor is public awareness among South Korean citizens regarding espionage. South Koreans must recognize the real threat posed by spies infiltrating deep into their society. The notion that spies no longer exist in the modern world is a utopian belief that must not deceive the public. It is essential for citizens to report suspicious individuals actively, thereby restricting the activities of these infiltrators. North Korea has consistently conducted operations targeting South Korea to create favorable conditions for its agenda. This strategy has persisted regardless of the ruling party, and North Korean spies often operate under disguised identities, embedding themselves within legitimate organizations to create an environment conducive to their activities. It is crucial for the public to recognize these intentions and develop the capacity to evaluate whether policy or legal changes might benefit North Korea. By fostering this awareness, South Koreans can work collectively to counteract the threats posed by espionage and safeguard their nation’s security.
Endnotes:
[1] Lee, M.-g. (2024, November 1). Exclusive: Trial delayed again in Changwon spy-ring case; defendant group requests recusal of bench. Dong-A Ilbo.
[2] Lee, K.-a. (2025, March 13). ‘Spy activities’: Sentence of 2 years confirmed for head of Chungbuk Comrades Association. Hankook Ilbo.
[3] Kim S.-e. (2025, May 16). North Korean spy case: Former KCTU executive convicted of espionage has sentence reduced on appeal. Chosun Ilbo.
[4] Jeong, G.j. (2025, February 28). Pyongyang Focus: Trends in North Korea’s operations targeting South Korea. Daily NK.
[5] Jeon, K.-w. (2023, June 13). Online campaign against the conservative camps under North Korean directives: Participation in comment manipulation and SNS public opinion operations. Jayupress.
[6] Kim, K.-m. (2025, February 19). Kim Gyeri: “Most of the societal conflicts in recent years were driven by North Korean espionage directives”. Sisa Focus.
[7] Kim, I.h. (2025, June 25). Breaking: ‘Support for Spy Law Amendment’ — Lee Jongseok, Director of NIS, says “Under discussion in the National Assembly… We must respond”. MoneyToday.
