North Korea’s hacker activity may become less predictable because the workforce appears to be drifting away from tight central control. That can mean more oversight from Pyongyang, less state-run ransomware, and more variation in who gets targeted and how much freelancing shows up under the DPRK label.
The report says some DPRK hacking units are losing control from the center, and it pairs that with rising attacks on American water infrastructure. The impact on those water targets is still limited, but the political response in the U.S. has been slow, which leaves the pressure on critical infrastructure in place.