This is a good point that no one has really pointed out based on my skimming, except for the OP saying they could stop all NK based attacks, which I’m guessing is based on blocking the 2 country routers.

However, a minimal amount of cyber attacks probably actually originate from NK directly. It’s known the NK hackers are trained in China and attacks probably flow through compromised VPS accounts, VPNs, open proxies, and open SOCKS-5 located around the world.

The NK hackers could be sitting in NK using the systems I referenced above to do their attacks and were not able to because they couldn’t connect to the internet. Maybe so, but they are most likely usually sitting in China and other locations.