In December, cyber security researcher Nick Roy discovered a cloud server at a wrong North Korean IP address that contained thousands of animation files, including cells, videos and project notes, indicating North Korean involvement in major international television programs. the findings, detailed in the report by the Stimson Center North Project 38 and a security company owned by Google MendiantPropose a means for North Korea to evade sanctions through skilled IT and technology workers.
as Reported by WiredNorth Korea’s tightly controlled internet landscape, with limited access and strict monitoring, stands in stark contrast to the discovery of an exposed cloud server that is regularly updated, which likely facilitated collaboration between North Korean animators, as suggested by Martin Williams, a senior fellow at the North 38 Project. This active digital presence within the otherwise restricted online environment raises questions about the regime’s digital activities and potential ways to evade sanctions.
Analysis of the discovered files revealed notes and editing instructions mostly in Chinese, translated into Korean, with detailed anime images and video clips. Identified shows included Amazon content Invinciblewhich is produced by California-based Skybound Entertainment, and the Max Show and Cartoon Network Iyanu: The prodigyProduced by YouNeek Studios, among others.
The sanctions imposed on North Korea prohibit American companies from cooperating with North Korean entities due to human rights violations and nuclear activities. However, researchers suggest that the companies involved in the TV shows are probably unaware of the involvement of North Korean animators. They speculate that any contracting arrangement would be removed in several stages from the main producers, thereby preventing direct violation of sanctions or laws.
Amazon and Maxx spokespeople declined to comment, while YouNeek Studios did not respond to inquiries. However, a spokesman for This was announced by Skybound Entertainment:
We do not work with North Korean companies, or Chinese companies on Invincible, or any related entities, and we have no knowledge of any North Korean or Chinese companies working on Invincible. We take every claim very seriously and have begun an investigation into the matter.
Williams suggests that it may employ a front company in China to hide North Korean involvement in the animation work. Although most connections to the exposed server were hidden by VPNs, analysis revealed access from Spain and three Chinese cities known for North Korean-operated businesses and overseas IT workers.
Although no names of North Korean organizations were identified in the files, it is worth noting that April 26 Animation Studio, also known as SEK Studio, has a long-standing presence in North Korea. However, the US Treasury did Confirmed by SEK Studios and people associated with using front companies to evade sanctions, many of them linked to China. These actions highlight concerns about illegal financial activities and fraud in the global animation industry.
Michael Barnhart, a researcher at Mandiant, emphasized the financial motive behind such activities, suggesting they serve to bolster North Korea’s coffers. He warned of the overlapping roles between North Korean IT workers and individuals who are members of known hacking groups or classified as persistent threats (APTs), and urged increased vigilance among companies.
This investigation into North Korea’s covert animation efforts highlights the complex interplay between technology, geopolitics, and international security.