Simon Choi

Early Career and Hauri

Simon Choi — whose Korean name has been transliterated in English-language press as both Choi Sang-myeon and Choi Sang-myung — is a South Korean malware researcher who has worked as a senior researcher at Hauri Inc., a Seoul-based antivirus software company. According to a 2021 profile in Asia Times, Choi became aware of a North Korean cyberattack campaign against South Korean military networks while completing his own mandatory military service around 2008, an experience that led him to organize a volunteer group of malware analysts after his discharge.

Founding IssueMakersLab

Choi founded IssueMakersLab (also written Issue Makers Lab), a volunteer collective of "white-hat" malware analysts, in 2008. Operating independently of any single company or government agency, the group has continuously tracked North Korean state-linked hacking activity since its founding, and its research has retroactively documented North Korean cyber operations back to 2004. IssueMakersLab members have reached the finals of the DEF CON Capture the Flag hacking competition and have presented research at Black Hat and CanSecWest, according to Asia Times.

Tracking North Korean Threat Actors Since 2008

Reporting on Choi's research spans more than a decade of incidents attributed to North Korean state hacking. In July 2013, the Associated Press reported that Choi and IssueMakersLab had found versions of a keyword-searching malware program dating to 2007 — a year earlier than antivirus firm McAfee had reported — used in intrusions that copied military-related documents from South Korean and allied computers. Choi's team concluded the code shared so many characteristics with malware used in the March 2013 "Dark Seoul" attacks on South Korean banks and broadcasters that it had been made by the same people.

In May 2017, following the global WannaCry ransomware outbreak, Choi — described by Reuters as a senior Hauri researcher who advises South Korean police and the National Intelligence Service — said the ransomware's code was similar to North Korea's backdoor malicious code and resembled malware previously tied to the 2014 Sony Pictures hack and earlier bank heists. His assessment paralleled conclusions independently reached by Symantec and Kaspersky Lab, though Choi cautioned at the time that a North Korea connection remained a possibility rather than a confirmed fact. In November 2019, The Quint reported that Choi's analysis linked a cyberattack on India's Kudankulam Nuclear Power Plant to North Korean-linked hacking infrastructure, describing a reconnaissance-and-deployment operation he attributed to two of the North Korean clusters IssueMakersLab tracks.

Lazarus Group and Andariel

IssueMakersLab has used its own internal designations — Choi has referred to them simply as "Group A," "Group B," and "Group C" — to distinguish separate North Korean hacking clusters by shared infrastructure and code, rather than immediately adopting the branded names later assigned by commercial vendors. According to The Quint's 2019 report, Choi's Group A, tied by his research to the 2009 distributed-denial-of-service attacks against South Korean and US government websites and to the 2014 Sony Pictures hack, corresponds to the cluster that other researchers — including Novetta's 2016 Operation Blockbuster investigation and subsequent reporting by Kaspersky and Symantec — named the Lazarus Group. Choi's 2017 WannaCry comments explicitly tied his own findings to that same Lazarus Group attribution.

In May 2018, BleepingComputer reported that Choi had documented "Operation GoldenAxe," an eleven-year pattern (2007-2018) of ActiveX-exploiting attacks against South Korean targets, including a then-current ActiveX zero-day used in watering-hole attacks. That activity corresponds to the cluster that antivirus vendor AhnLab and other researchers track as Andariel, a sub-group associated with North Korea's Reconnaissance General Bureau. As with Lazarus Group, available reporting does not establish that Choi personally coined the Andariel name; rather, his independent tracking of the same activity cluster, under his own classification, corroborated and in some respects predated the public naming and attribution work done by other firms.

Cyber Warfare Intelligence Center

BleepingComputer's 2018 reporting identifies Choi as "a South Korean security researcher and founder of the Cyber Warfare Intelligence Center" (CWIC), a research body distinct from IssueMakersLab. Available English-language sourcing does not establish CWIC's founding date, structure, or membership beyond this identification.

Advisory Role

Multiple outlets describe Choi in an advisory capacity to South Korean state institutions. Reuters reported in 2017 that Choi advises South Korean police and the National Intelligence Service. Asia Times reported in 2021 that IssueMakersLab has done work for South Korea's Ministry of National Defense and National Intelligence Service, and that Choi personally serves as an advisor to the National Police Agency.

Impact and Legacy

For more than fifteen years, Choi and IssueMakersLab have provided a continuous, non-governmental record of cyberattacks attributed to North Korean state actors — from the 2009 DDoS attacks and the 2013 Dark Seoul intrusions through the 2014 Sony Pictures hack, the WannaCry outbreak, ActiveX zero-days, and attacks on foreign targets such as India's Kudankulam plant. In 2023, the Korea Times cited IssueMakersLab data showing North Korean cyberattacks recorded by the group rising roughly 300-fold between 2004 and 2020. That independent, Korea-based body of research has repeatedly served international media outlets as a corroborating source alongside larger commercial threat-intelligence vendors, helping establish that North Korean cyber operations have been tracked, in near real time, by researchers working from inside South Korea rather than by distant Western security firms alone.

Timeline

• 2008Founded IssueMakersLab, a volunteer group of malware analysts, after observing a North Korean cyberattack campaign during his military service.
• 2009North Korea-linked DDoS attacks hit South Korean and US government websites; IssueMakersLab later classified them, under its own 'Group A' designation, as the work of the cluster other researchers would name Lazarus Group.
• 2013-07-11The Associated Press reported that Choi's IssueMakersLab had traced 'Dark Seoul'-linked keyword-searching malware to 2007, a year earlier than previously reported by McAfee.
• 2017-05-16Following the WannaCry outbreak, Choi, then a senior researcher at Hauri, said the ransomware's code resembled North Korean malware used in the Sony Pictures hack and prior bank heists, corroborating Symantec and Kaspersky Lab's Lazarus Group attribution.
• 2018-05-31BleepingComputer reported that Choi, identified as founder of the Cyber Warfare Intelligence Center, had documented 'Operation GoldenAxe,' an 11-year pattern of ActiveX-exploiting attacks against South Korea tied to the cluster tracked elsewhere as Andariel.
• 2019-11-06The Quint reported Choi's analysis linking a cyberattack on India's Kudankulam Nuclear Power Plant to North Korean-linked hacking clusters.
• 2021-02-27Asia Times profiled Choi and IssueMakersLab, detailing the group's DEF CON CTF finals appearances, Black Hat and CanSecWest talks, and Choi's advisory work for South Korea's Ministry of National Defense, National Intelligence Service, and National Police Agency.
• 2023-07-20The Korea Times cited IssueMakersLab data showing North Korean cyberattacks recorded by the group increasing roughly 300-fold between 2004 and 2020.