North Korean Intelligence: History, Structure, and the Headlines

North Korea is one of the poorest and most isolated states in the world, yet its intelligence services have reached into banks in New York and Dhaka, a Hollywood studio, a Malaysian airport, cryptocurrency exchanges, and the payrolls of hundreds of American companies. For North Korean intelligence, theft has become a large part of the job. The United Nations panel that monitored sanctions on Pyongyang concluded in 2024 that cyber operations supplied about half of the country’s foreign currency earnings. Anyone whose work touches East Asian security, financial crime, cryptocurrency, or remote hiring needs to understand these services.

This page is a working overview of North Korea’s intelligence and security services: where they came from, how they are organized today, and the cases that have put them in the news. Pyongyang publishes almost nothing about them, so the page relies on U.S. indictments and sanctions designations, UN and multinational monitoring reports, South Korean government assessments, court outcomes in other countries, and named reporting. North Korean statements, which reach the world through the state news agency KCNA, are included where Pyongyang has responded. Each allegation is attributed, and the page gives the legal status of each case as of October 2026.

North Korean intelligence at a glance

• Main foreign intelligence service: the Reconnaissance General Bureau (RGB, Chongchalchongguk), created in 2009 by merging the Workers’ Party’s Operations Department and Office No. 35 with the army’s Reconnaissance Bureau (Joseph Bermudez, 38 North). In September 2025, South Korea’s Unification Ministry said the North was presumed to have expanded it into a General Reconnaissance Information Bureau (Korea Times).
• Head: North Korea does not announce the appointment. South Korea’s Foreign Ministry identified Ri Chang Ho as head of the RGB when it sanctioned him in December 2023 (Al Jazeera), and the U.S. Treasury named him in the same post when it sanctioned him in December 2024 (Korea Daily). Whether he leads the renamed bureau has not been publicly confirmed.
• Domestic security and political police: the Ministry of State Security (Kukka Bowisong, earlier the State Security Department, Kukka Bowibu), renamed in early 2026. Seoul’s English-language press translates the new name as “State Information Bureau” (Korea Herald); other outlets use “National Intelligence Agency.” KCNA identified Ri Chang Dae as its head when he led a delegation to Moscow in May 2026 (Korea JoongAng Daily).
• Police: the Ministry of Social Security, renamed from the Ministry of People’s Security in 2020 (Daily NK). In March 2026, Kim Jong Un called for its forces to be reorganized into a police structure (Korea Herald).
• Party covert work against the South: the Workers’ Party United Front Department, abolished after 2023 when Pyongyang redefined South Korea as a hostile state. Its functions moved to a “10th Bureau” and, by April 2026, to a Tenth Department inside the Foreign Ministry (Yonhap via Korea JoongAng Daily).
• Oversight and reporting line: there is no independent oversight. The services answer to Kim Jong Un through the party and state apparatus; in July 2026 the party’s Central Military Commission, which he chairs, ordered the reconnaissance bureau’s missions expanded (Yonhap via Korea Times).
• Relationship with the United States: adversarial. The U.S. Treasury designated the RGB in 2010 and again in 2015 and calls it “the DPRK’s primary foreign intelligence service” (U.S. Treasury).

History: from commando raids to cyber theft

North Korea’s early intelligence record is one of raids, bombings, and kidnappings aimed at South Korea and its allies. On the night of January 21, 1968, a team of North Korean commandos came close to the Blue House, the presidential residence in Seoul, in an attempt to kill President Park Chung-hee. A captured raider said the team had also planned to kill the UN forces commander and the U.S. ambassador. Two days later, on January 23, North Korean forces seized the U.S. intelligence ship USS Pueblo, killing one crew member and capturing 82. The crew was released on December 23, 1968, after the United States handed over a paper of apology that its negotiator publicly repudiated at the same time (Association for Diplomatic Studies and Training; U.S. Office of the Historian).

On October 9, 1983, a bomb exploded at the Martyrs’ Mausoleum in Rangoon, Burma, shortly before President Chun Doo-hwan was due to arrive. It killed 17 South Koreans, including four cabinet ministers, and four Burmese. Burmese authorities identified three North Korean military officers as the attackers: one was killed resisting arrest, one was executed, and one, Kang Min-chul, confessed, was sentenced to life, and died in prison in 2008. Burma cut diplomatic ties with Pyongyang and did not restore them until 2007. North Korea has denied any link to the attackers (Korea Herald).

On November 29, 1987, Korean Air Flight 858 exploded over the Andaman Sea, killing all 115 people aboard. Two North Korean agents traveling on forged Japanese passports were caught in Bahrain; the older man died after biting a cyanide capsule, and Kim Hyon-hui survived. She confessed in January 1988, saying the order came from Kim Jong Il to disrupt the Seoul Olympics. She was sentenced to death in 1990 and pardoned by President Roh Tae-woo (Korea Herald). The United States added North Korea to its list of state sponsors of terrorism in 1988, citing the Rangoon and KAL 858 attacks among other reasons (Korea JoongAng Daily).

In the same decades, North Korean agents abducted Japanese citizens. In September 2002, at a summit in Pyongyang with Japan’s prime minister, North Korea acknowledged the abductions and apologized, and five abductees returned to Japan the following month. Japan has identified 17 of its citizens as abduction victims and says North Korea has given no “satisfactory account” of the others (Ministry of Foreign Affairs of Japan).

The modern structure dates from 2009, when the RGB was formed from party and military espionage units under Lieutenant General Kim Yong Chol (Joseph Bermudez, 38 North). The new bureau kept the old missions of infiltration and sabotage, but over the following decade its hacking units became its best-known product.

How North Korean intelligence is organized today

North Korea publishes no intelligence law, budget, or organizational chart. What is known comes from defectors, South Korean government assessments, and foreign sanctions designations, and the structure changed significantly in 2025 and 2026.

• The Reconnaissance General Bureau, now presumed by Seoul to be the General Reconnaissance Information Bureau, is the main foreign intelligence service. It runs espionage, special operations, and the hacking groups that the U.S. government calls Lazarus Group, Bluenoroff, and Andariel, along with Kimsuky, which Treasury describes as subordinate to the RGB (U.S. Treasury, 2019; U.S. Treasury, 2023). In July 2026, KCNA reported that the Central Military Commission had called for the bureau’s functions and missions to be expanded “in a many-sided way” (Yonhap via Korea Times).
• The Ministry of State Security, renamed in early 2026, is the political police. It monitors and suppresses dissent and runs counterintelligence (Korea Times). Analysts disagree about whether the renaming signals a real expansion into intelligence work or only a softer image (Daily NK).
• The Ministry of Social Security runs the regular police and public order, combined with surveillance of daily life (Korea Herald).
• The Military Security Command polices the armed forces for disloyalty and espionage. South Korea’s 2018 Defense White Paper lists it as the Military Security Bureau in the North’s military command chart (Republic of Korea Ministry of National Defense).
• Inter-Korean covert work, formerly the United Front Department’s, was downgraded to a 10th Bureau of the party in 2024. South Korea’s unification minister said at the time that “functions such as psychological warfare against the South” were continuing unchanged (Asia Economy). North Korea confirmed in April 2026 that a Tenth Department of the Foreign Ministry now handles relations with the South (Yonhap via Korea JoongAng Daily).

Two features stand out. First, the services are built to protect one family’s rule, so domestic control, foreign espionage, and military discipline are spread across several bodies that each answer to the leadership. Second, almost every name, head, and reporting line is an assessment rather than a published fact. Seoul’s ministries, Western sanctions lists, and specialist outlets sometimes use different names for the same body, and appointments often surface only when an official appears in KCNA photographs or on a sanctions list.

Intelligence as revenue

Most intelligence services spend money. North Korea’s also earn it. When the U.S. Treasury sanctioned the Lazarus Group and its offshoots in 2019, it said that “Bluenoroff was formed by the North Korean government to earn revenue illicitly in response to increased global sanctions,” and estimated that the three groups had likely stolen about $571 million in cryptocurrency from five Asian exchanges (U.S. Treasury).

The UN Security Council’s Panel of Experts tracked the scale. In early 2024, it was investigating 58 suspected North Korean cyberattacks from 2017 to 2023 valued at about $3 billion, and it said the hacking groups report to the RGB (AP via SecurityWeek). Its March 2024 report said cyber theft accounted for about 50 percent of North Korea’s foreign currency earnings and that 40 percent of the funding for its weapons of mass destruction programs came through illegal cyber means (Asia Economy). On March 28, 2024, Russia vetoed the renewal of the panel’s mandate, which then lapsed at the end of April. Russia called the sanctions the work of a Western coalition seeking “to strangle Pyongyang” (JURIST); the United States, the United Kingdom, and other governments said the veto was meant “to shield from public view the DPRK’s persistent sanctions evasion efforts” (UK Government).

Eleven countries, including the United States, Japan, South Korea, and the United Kingdom, then set up the Multilateral Sanctions Monitoring Team (AP via MyNorthwest). Its October 2025 report found that North Korea stole about $1.19 billion in cryptocurrency in 2024 and $1.65 billion in the first nine months of 2025. It estimated that 1,000 to 2,000 North Korean IT workers were stationed in at least eight countries, mainly China and Russia, earning $350 million to $800 million in 2024 and sending roughly half to the state (Korea Herald). In January 2026, the U.S. State Department said the total stolen in 2025 had passed $2 billion (Global Sanctions).

Pyongyang rejects the monitors. In January 2026, its UN mission, in a statement carried by KCNA, called the team an “illegal ghost organization that has no connection with the U.N. in practice” (Korea Times). It did not directly dispute the theft figures. A July 2026 analysis by South Korea’s Korea Institute for National Unification read the Central Military Commission’s orders as listing cyber operations for intelligence, foreign currency earnings, and technology theft among the reconnaissance bureau’s expanded missions (Korea Herald via Asia News Network).

North Korean intelligence in the news

Most public knowledge of how North Korea’s services operate comes from six cases. In most of them, the evidence comes from U.S. prosecutors, foreign courts, or the South Korean government, and the North Korean individuals charged have never appeared in a courtroom.

Sony Pictures (2014–2021)

In November 2014, hackers destroyed data and leaked files at Sony Pictures Entertainment ahead of the release of The Interview, a comedy about a plot to kill Kim Jong Un. In December 2014, the FBI concluded that the North Korean government was responsible, and the White House said it stood by that finding. North Korea called the accusation “groundless slander” and proposed a joint investigation, which Washington rejected (RFE/RL). The U.S. Treasury later stated that the Lazarus Group “was also directly responsible” for the attack (U.S. Treasury), and the attack is among the charges in the U.S. cases described below.

The Bangladesh Bank heist (2016–present)

In February 2016, hackers stole $81 million from Bangladesh Bank’s account at the Federal Reserve Bank of New York. In September 2018, the Justice Department unsealed a criminal complaint charging Park Jin Hyok, a North Korean programmer, with conspiracy over the heist, the Sony attack, and the WannaCry ransomware. Prosecutors said he worked for Chosun Expo Joint Venture, a government front company “affiliated with Lab 110, a component of DPRK military intelligence” (U.S. Department of Justice). In February 2021, prosecutors unsealed an indictment of Park, Jon Chang Hyok, and Kim Il, describing them as members of RGB units and alleging a scheme to steal and extort more than $1.3 billion from banks and companies (U.S. Department of Justice). The charges remain allegations; none of the three has been tried.

The killing of Kim Jong Nam (2017–2019)

On February 13, 2017, Kim Jong Nam, the estranged half-brother of Kim Jong Un, was killed at Kuala Lumpur International Airport when two women smeared VX nerve agent on his face. Four North Korean men named as co-conspirators left Malaysia the same day. The women, an Indonesian and a Vietnamese, said they thought they were taking part in a television prank. Malaysia dropped the murder charge against Siti Aisyah in March 2019. Doan Thi Huong pleaded guilty to a lesser charge of causing injury in April 2019 and was released in May. Malaysian officials never formally accused North Korea, and no one has been convicted of murder (AP via The Garden Island). North Korea denied involvement. KCNA said the man had “died of heart stroke” and that “the biggest responsibility for his death rests with the government of Malaysia” (Stars and Stripes).

North Korean troops in Russia (2024–2025)

On October 18, 2024, South Korea’s National Intelligence Service said Russian navy ships had carried about 1,500 North Korean special forces troops to Vladivostok between October 8 and 13, and it published satellite imagery as support. The Kremlin had earlier called such reports “another piece of fake news” (Al Jazeera). By April 30, 2025, the NIS was telling lawmakers that about 15,000 troops had been sent and that about 4,700 had been killed or wounded, and that the North had received technical help with reconnaissance satellites in return (Korea JoongAng Daily). On April 28, 2025, after months in which officials neither confirmed nor denied the deployment, the party’s Central Military Commission acknowledged that North Korean troops had fought in Russia’s Kursk region, citing the 2024 mutual defense treaty (38 North). When the Multilateral Sanctions Monitoring Team reported in mid-2025 that North Korea had shipped Russia more than 20,000 containers of munitions, North Korea’s Foreign Ministry called the report “political and biased” and its military cooperation a “legitimate exercise of the sovereign right” (Reuters via Free Malaysia Today).

The IT worker schemes (2024–2026)

Since 2024, U.S. prosecutors have charged Americans and others with helping North Korean IT workers get remote jobs at U.S. companies under stolen or borrowed identities, often by hosting “laptop farms” of company computers that the workers controlled remotely. On June 30, 2025, the Justice Department announced coordinated actions, including searches of laptop farms in more than a dozen states, new indictments in Massachusetts and Georgia, and the arrest of a New Jersey man, Zhenxing Wang (U.S. Department of Justice). Several defendants have since pleaded guilty and been sentenced. Christina Chapman, whose laptop farm served schemes that exploited more than 300 U.S. companies and government agencies, received 102 months in July 2025 (NK News). Oleksandr Didenko, a Ukrainian who ran a website selling stolen identities to the workers, received five years in 2026 (The Register). In April 2026, a federal judge in Massachusetts sentenced Kejia Wang to 108 months and Zhenxing Wang to 92 months for a scheme that prosecutors said produced more than $5 million for the North Korean government (Washington Times), and in May 2026 two more U.S. facilitators were sentenced to 18 months each (CyberScoop). The four North Korean nationals charged in the Georgia case remain at large.

The Bybit theft (2025)

On or about February 21, 2025, hackers stole about $1.5 billion in virtual assets from the cryptocurrency exchange Bybit. Five days later, the FBI stated that North Korea “was responsible for the theft,” attributing it to activity it calls TraderTraitor (FBI Internet Crime Complaint Center). No one has been charged. North Korea, which called the Sony attribution “groundless slander,” made no public statement on Bybit that this page could locate.

How to read coverage of North Korean intelligence

Nearly every piece of information about North Korea’s services comes from a party with a point of view. KCNA and the Rodong Sinmun are state media and speak for the government. South Korea’s National Intelligence Service briefs lawmakers behind closed doors, and lawmakers from different parties sometimes summarize the same briefing differently. Seoul’s Unification Ministry offers “presumed” readings of appointments and reorganizations. Specialist outlets such as Daily NK rely on anonymous sources inside the country, which can be valuable but are hard to check. Cybersecurity firms give the same hacking group different names, and their attributions are commercial products as well as research.

The discipline is the one taught in our guides to trend analysis and evaluating forecasts: climb toward primary records. For North Korea, that means U.S. indictments and plea agreements in federal court, Treasury’s sanctions designations, FBI public service announcements, the UN Panel of Experts reports filed before 2024, the Multilateral Sanctions Monitoring Team’s reports, and KCNA’s own statements read as the government’s position. For lobbying and consulting work on Korean issues in Washington, the U.S. Justice Department’s database of registered foreign agents (FARA eFile) is the place to check. A single unnamed source on a purge or an appointment is a lead, not a finding, until state media or a second government confirms it.

Frequently asked questions

Related reading

• Intelligence Services Around the World: Structure, History, and the Headlines
• Qatari Intelligence: History, Structure, and the Headlines
• South Korean Intelligence: History, Structure, and the Headlines
• Trend Analysis: How to Tell a Real Trend From Media Hype

Competitive Futures briefs companies and governments on intelligence services, foreign influence, and the Korean Peninsula and East Asia; details are on the services page.