Cyber Incident Victim: North Korean Short-Wave Radio Station 6400kHz
Date:
Nov 2017
Location:
North Korea
Summary
An unknown hacker hijacked a North Korean state-run shortwave radio station broadcasting on 6400kHz, replacing its transmission with the song "The Final Countdown." The incident was publicized by vigilante hacker "The Jester," who claimed the intrusion targeted a station allegedly used by the regime to transmit coded messages preceding major weapons tests, including nuclear and ballistic missile launches. Strategic Sentinel, a geostrategic consulting group, reported historical correlations between the station's coded broadcasts and subsequent military activities, noting transmissions occurred days prior to multiple tests. The station, linked to Pyongyang Broadcasting Station, is believed to facilitate covert communications for the regime.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On November 9, 2017, an unidentified hacker disrupted North Korea’s short-wave radio station broadcasting on 6400kHz, replacing its normal transmissions with the 1986 song "The Final Countdown" by the band Europe. The station, operated from Kanggye and linked to Pyongyang Broadcasting Station, was hijacked for an unspecified duration. The incident gained public attention after the vigilante hacker known as "The Jester" announced it on social media, posting: "A god among us has hijacked 6400kHz (North Korean station) and is playing the Final Countdown." The Jester had prior notoriety for targeting extremist websites and Russian government domains. The compromised frequency was part of a network that included broadcasts on 621kHz, 1053kHz, and 3250kHz, though only 6400kHz was confirmed affected.
Strategic Sentinel, a Washington-based geostrategic consulting firm, identified the station as a conduit for encrypted North Korean communications, often preceding weapons tests. Their analysis revealed coded messages had been transmitted two days before the country’s sixth nuclear test, one day before its first intercontinental ballistic missile (ICBM) test, and one day before missile overflights of Japan. The hack disrupted this covert signaling system but did not involve data theft or infrastructure damage. No attribution or motive was disclosed, and North Korea did not publicly acknowledge the breach. The incident highlighted vulnerabilities in Pyongyang’s clandestine communication methods while demonstrating how non-state actors could temporarily compromise state-controlled media platforms.