Banks in South Korea and elsewhere are being targeted for foreign currency, a report says.
Cyber-criminals are targeting financial institutions as Pyongyang faces tough nuclear sanctions, the Financial Security Institute (FSI) claims.
Suspected hacking attempts were until recently thought to be aimed at causing disruption or accessing data.
North Korea has routinely denied involvement in cyber-attacks.
The FSI analysed cyber-attacks between 2015 and 2017.
The impoverished country is now facing even tougher international sanctionsaimed at stopping the flow of money that would support the development of its weapons programme.
Perhaps the most high profile hack linked to North Korea in recent years targeted Sony’s entertainment business in 2014 – wiping out massive amounts of data and leading to the online distribution of emails, personal and sensitive employee data as well as pirated copies of new movies.
However the FSI is not alone in saying there had been a shift away from this kind of disruptive, embarrassing hack, and towards cyber-attacks raising money.