Key Takeaways:
North Korea is building a three-way intelligence axis with Russia and China to overcome critical gaps in satellite surveillance, cyber operations and overseas espionage.
Kim Jong Un ordered a radical expansion of North Korea's intelligence network this month, tapping Russian satellite expertise and Chinese diplomatic reach to close gaps exposed by the country's 43 overseas posts and single spy satellite in orbit. The North Korean leader presided over a meeting that called for "radical" enhancements to military reconnaissance and intelligence capabilities, according to state media.
"North Korea, Russia and China could develop a division of labor in which cyber and intelligence units focus on different regions and share selected information," said Joseph Bermudez Jr., a North Korea specialist at the Center for Strategic and International Studies. Such cooperation would not resemble the institutionalized Five Eyes partnership among the United States, Britain, Canada, Australia and New Zealand, he said, but could involve informal exchanges of satellite images, intercepted communications and cyberattack techniques.
The upgrade follows the September 2025 restructuring of the Reconnaissance General Bureau into the General Reconnaissance and Information Bureau, which oversees conventional espionage, overseas covert operations, cyberattacks and satellite reconnaissance. South Korea's spy agency said Russia is providing technical assistance for satellite launches in return for North Korean troops deployed to support Moscow's war in Ukraine. Ukrainian President Volodymyr Zelensky said Russia is seeking 30,000 additional North Korean soldiers, a deployment that would strengthen Pyongyang's military threat in Asia.
An expanded intelligence partnership among the three U.S. adversaries could amplify cyber threats to South Korean government agencies, defense contractors and financial institutions while giving Pyongyang the satellite constellation needed to track U.S. military movements across the region in near real time. A single satellite provides limited coverage because it passes over a target area periodically; multiple satellites operating together would allow North Korea to collect images more often and track military movements more effectively.
Satellite Gaps and Russian Technology
North Korea's only known operational reconnaissance satellite, Malligyong-1, reached orbit in November 2023, though outside analysts have questioned the quality of the images it can produce. Subsequent launch attempts have failed or experienced delays. Kim visited Russia's Vostochny Cosmodrome during his September 2023 summit with President Vladimir Putin, a location that security analysts said highlighted Pyongyang's interest in acquiring Russian knowledge related to launch vehicles and satellite operations.
Russian assistance could help North Korea build a group of reconnaissance satellites capable of monitoring South Korea, Japan and U.S. military facilities more frequently. North Korean and Russian cyber operators may also benefit from sharing malware, infrastructure and technical expertise. United Nations investigators said they examined dozens of suspected North Korean cyberattacks against cryptocurrency companies between 2017 and 2023, with hackers accused of stealing billions of dollars in digital assets to finance state programs restricted by international sanctions.
Diplomatic Expansion Creates New Risks
North Korea maintained diplomatic missions in about 43 countries as of 2024, compared with 271 for the United States, according to the Lowy Institute. The country's diplomats and trade representatives have previously been accused of supporting weapons transactions, sanctions evasion and intelligence operations. Kim held his first summit with Belarusian President Alexander Lukashenko in March, and Belarus plans to open its first embassy in Pyongyang in August.
An expanded diplomatic network could give North Korea more opportunities to monitor foreign communications and support overseas cyber operations, said Chun In-bum, a former South Korean Special Warfare Commander. North Korean hackers have previously operated from or used infrastructure connected to countries with diplomatic relations with Pyongyang, according to United Nations reports.
The last time North Korea significantly expanded its overseas intelligence footprint, it preceded the 2014 cyberattack against Sony Pictures Entertainment, the theft of South Korean and U.S. military plans in 2016 and the 2017 assassination of Kim's half brother Kim Jong Nam in Malaysia. Pyongyang has denied responsibility for the Sony attack and involvement in Kim Jong Nam's death. Analysts warned that closer cooperation with Russia and China could help North Korea overcome weaknesses in human intelligence, satellite surveillance and international access, increasing risks for South Korean government agencies, defense companies and overseas diplomatic missions.
This article is for informational purposes only and does not constitute investment advice.
