Park Jin Hyok

Early Life

Park Jin Hyok attended the Kim Chaek University of Technology in Pyongyang, one of North Korea's premier institutions for technical education. He subsequently traveled to China, where he conducted IT work on behalf of Chosun Expo Joint Venture — also known as Korea Expo Joint Venture — a front company affiliated with the North Korean government.

Career

Park worked for Chosun Expo Joint Venture, an organization linked to Lab 110, a component of North Korea's military intelligence apparatus. Through this role, he is alleged to have supported the North Korean government's offensive cyber operations. Chosun Expo maintained offices in both China and North Korea, providing operational cover for activities conducted on behalf of the state.

Park is identified as a member of the Lazarus Group, also tracked under the designation APT 38. The Lazarus Group is a government-funded hacking collective widely attributed to North Korea's Reconnaissance General Bureau, the country's primary foreign intelligence agency.

Notable Work

Sony Pictures Hack

In November 2014, Park and alleged co-conspirators launched a destructive cyberattack against Sony Pictures Entertainment. The attack is believed to have been carried out in retaliation for The Interview, a political comedy film depicting the assassination of North Korea's leader by a CIA operative. The intrusion resulted in significant data destruction and the public release of sensitive corporate information. North Korea denied any involvement in the attack.

WannaCry Ransomware Attack

The U.S. Department of Justice charged Park in connection with the WannaCry ransomware attack of 2017, one of the most disruptive cyberattacks ever recorded. WannaCry spread by exploiting vulnerabilities in networked systems, encrypting files on infected machines and demanding ransom payments in cryptocurrency in exchange for decryption keys. The attack propagated rapidly across organizations worldwide. Among its most notable victims was the United Kingdom's National Health Service, where compromised systems led to the cancellation of thousands of patient appointments.

Legal Status

Park Jin Hyok is listed on the FBI's wanted list in connection with his alleged role in these and other intrusions. The U.S. Department of Justice has formally charged him, though he has not been apprehended. The North Korean government officially denies his existence, consistent with its broader posture of rejecting attribution for state-sponsored cyber activities.