North Korea Inside
· North Korea Conducts Drills Involving Returned Troops to “Transfer Battlefield Lessons” from the Ukraine War
· North Korea’s Nighttime Brightness Has Increased Sevenfold in Four Years
· Kim Jong Un’s Daughter Ju-ae Independently Receives Salute from Air Force Officers
· North Korean Hacking Group Lazarus Likely Responsible for $445 Million Upbit Heist
Kim Myong-sung
Analysts warn that should Pyongyang succeed in merging its enhanced nuclear capabilities with an upgraded and modernized conventional doctrine, particularly one informed by lessons from a conflict characterized by drones, AI systems, and precision-strike technologies, the resulting shift would pose a substantial challenge to the deterrence posture maintained by the ROK–U.S. Alliance.
According to a knowledgeable source familiar with North Korean military developments, the General Staff initiated an inspection on November 7 of an integrated training program at its dedicated special operations training facility, following directives from the Supreme Command. Between November 8 and 22, combined training was carried out involving special operations forces and sniper units, with evaluators from the KPA Operations Bureau overseeing assessments of newly adapted combat tactics.
The contingent deployed to Ukraine is reportedly the 11th Corps (commonly known as the “Storm Corps”), the KPA’s premier special operations unit, roughly analogous to the Republic of Korea’s Special Warfare Command.
Training focused heavily on counter-drone measures and coordinated sniper–special forces operations. Reporting indicates that Pyongyang is attempting to codify operational norms on both drone evasion and tactical drone employment, drawing directly from front-line experience in Ukraine.
Sniper units underwent intensive evaluation on precision observation, target identification, long-range marksmanship, communications proficiency, and target elimination. Special operations elements were assessed on infiltration, concealment, close-quarters engagement, rapid extraction, and small-unit tactical cohesion.
One source noted that commanders have maintained an unusually high training tempo, reportedly instructing troops that they “have no right to die until the mission is accomplished.” The comment reflects growing indications that the KPA leadership is enforcing intensified training cycles even while deployment-related fatigue remains evident among units still operating in Ukraine.
A military official familiar with allied assessments stated that Pyongyang “appears to have concluded from this conflict that modernization of conventional forces is as essential as nuclear development,” adding that the regime is attempting to institutionalize battlefield lessons before operational memory dissipates.
According to South Korea’s National Intelligence Service, Kim Jong-un deployed roughly 10,000 elite personnel from the Special Operations Forces and the Reconnaissance General Bureau to the Russia–Ukraine war in October of last year. Analysts assess that Pyongyang avoided deploying frontline units facing South Korean forces and also refrained from sending second-tier units considered insufficiently combat-capable.
Reporting from Ukrainian intelligence and international media indicates that North Korean forces initially faced significant distrust and discrimination within the Russian military due to racial prejudice, linguistic barriers, and skepticism regarding their combat effectiveness. Additional reports of desertion, theft, and disciplinary violations appear to have exacerbated tensions.
Russian forces reportedly assigned North Korean units to high-risk open-field assaults without adequate fire support, resulting in substantial casualties under Ukrainian drone attacks. Nearly 3,000 North Korean soldiers are believed to have been killed or injured within the first month of deployment.
U.S. intelligence reporting suggests that North Korean troops’ operational performance improved considerably by late February. Multiple sources indicate that the launch of Russia’s offensive to retake the Kursk region, timed immediately after the collapse of the Trump–Zelensky summit, relied heavily on “reorganized” North Korean units. Supported by Russian firepower, North Korean troops reportedly employed refined counter-drone tactics and played a central role in cutting Ukrainian supply lines, contributing materially to the Kursk operation.
At the time, Pentagon spokesperson Maj. Gen. Pat Ryder assessed that North Korean forces were “relatively well-trained and capable,” noting that while they remain infantry-centric, they are emerging as a “meaningful threat” on the battlefield.
Available intelligence indicates that within one month of their arrival, North Korean units reorganized their formations and incorporated updated counter-drone procedures. Despite sustained operations over roughly two months, casualties among reorganized forces are estimated to have remained around 2,000 personnel.
Satellite imagery analysis indicates that North Korea’s nighttime illumination has increased sevenfold over the past four years. In the context of a decade of sanctions, this trend suggests substantial growth in military and heavy-industrial output, largely driven by North Korea–Russia defense cooperation. However, the expansion has not translated into improvements in the civilian economy, which continues to contract under inflationary pressures and tighter state controls over markets and foreign exchange.
At a forum titled “Ten Years of Sanctions on North Korea: The North Korean Economy,” held in Seoul on December 3, KIEP researcher Kim Da-wool reported that nighttime brightness indices for the first three quarters of the year were approximately seven times higher than in 2021. Kim assessed that the trend reflects improvements in both electricity production and distribution, as well as increased consumption for lighting.
Manufacturing activity indicators—derived from satellite measurements of radiant heat, temperature, illuminance, nitrogen dioxide levels, and surface activity—show a sharp rise beginning in the second quarter of 2023. Kim projected a higher manufacturing growth rate for 2024 relative to the previous year.
Researchers at the Korea Development Institute (KDI) concluded that industrial regions specializing in heavy and chemical industries, as well as areas supporting military production, experienced disproportionate growth compared with light-industry zones. They attributed this divergence to expanded military cooperation with Russia, including large-scale artillery and materiel transfers, which have pushed heavy industry into what they describe as an “overheated” phase.
However, satellite-based assessments of market logistics and stall activity indicate contraction in general market operations, pointing to stagnation in civilian livelihoods. Contributing factors include rising prices and declines in household income, driven by heightened state controls over grain distribution and foreign exchange transactions. KDI researchers reported no measurable spillover effects from defense-industrial growth into broader civilian economic activity.
Experts warn that this divergence is reinforcing structural imbalances within North Korea’s economy. As one analyst noted, increasing nighttime illumination may signal industrial recovery, but it does not necessarily reflect improvements in living standards. With limited national resources increasingly diverted toward military and heavy-industrial sectors, conditions in the civilian economy are steadily deteriorating.
Kim Jong Un’s Daughter Ju-ae Independently Receives Salute from Air Force Officers
Kim Jong Un’s daughter, Kim Ju-ae, was recently observed receiving a formal salute from Air Force officers in the absence of her father, marking her first public appearance in roughly 90 days since attending China’s Victory Day celebrations last September. The incident underscores her increasingly prominent public profile and supports assessments that her status within the regime is being institutionally elevated, potentially in line with succession-related positioning.
According to reporting by the Rodong Sinmun on November 30, “a grand event commemorating the 80th anniversary of the founding of the Korean People's Army Air Force was held on November 28 at Kalma Airfield of the 2nd Air Division,” noting that Kim Jong-un attended the event accompanied by his daughter.
The state newspaper referred to her only as “the respected offspring who accompanied him,” omitting her name. At the event, Kim Ju-ae appeared in attire closely mirroring Kim Jong-un’s, including a long leather coat and sunglasses: available imagery suggests she may now also be taller than her father.
Of particular note, footage from Korean Central Television showed Kim Ju-ae receiving salutes from officers independently, without Kim Jong-un present. This is the first known instance of such a scene since her public debut three years ago, suggesting that within North Korean protocol, she is increasingly treated as a representative or proxy for the supreme leader.
A precedent highlighting her elevated status occurred exactly two years earlier. On November 29, 2023, she accompanied Kim Jong-un on visits to the Air Force Command and the 1st Air Division in Hwangju to commemorate the 78th anniversary of the Air Force’s founding.Among the photographs released at the time was an image in which Kim Jong-un positioned her directly in front of him, visually placing her at the center of the occasion. This moment is widely regarded as having prompted South Korean intelligence agencies to reassess her political standing.
South Korea’s National Intelligence Service, the Joint Chiefs of Staff, and other government bodies are paying close attention to the timing of Kim Ju-ae’s latest appearance, noting its alignment with Aviation Day. A senior security official observed that, during his own succession period, Kim Jong-un was promoted domestically as a “genius of artillery tactics,” suggesting that it is plausible that Kim Ju-ae will be highlighted in connection with achievements tied to the Air Force.
North Korea has a history of associating major weapons tests with Aviation Day. On November 29, 2017, the regime launched the Hwasong-15 intercontinental ballistic missile, declaring the “completion” of its nuclear force: Kim Ju-ae was five years old at the time. Five years later, on November 17, 2022, again in proximity to Aviation Day, North Korea launched the Hwasong-17, an upgraded variant of the Hwasong-15. That day also marked Kim Ju-ae’s first public appearance.
North Korean Hacking Group Lazarus Likely Responsible for $445 Million Upbit Heist
Strong indications suggest that the Lazarus Group, a hacking organization affiliated with North Korea’s Reconnaissance General Bureau, is responsible for the recent cyberattack on South Korea’s largest virtual asset exchange, Upbit, in which approximately 44.5 billion won (about $445 million) worth of virtual assets were stolen. Authorities remain cautious, however, emphasizing that securing definitive forensic evidence will take time.
On November 28, the National Intelligence Service, the National Police Agency, the Financial Supervisory Service, and the Korea Internet & Security Agency (KISA) launched a joint on-site investigation at Upbit headquarters. The National Police Agency’s Cyber Terror Investigation Unit has opened a parallel inquiry and joined the interagency effort.
The cybersecurity sector broadly assesses the likelihood of Lazarus involvement as high. Analysts point to the group’s previous operations, including the November 27, 2019 theft of 58 billion won in Ethereum from Upbit, an operation linked to Lazarus and Andariel, another unit under North Korea’s Reconnaissance General Bureau.
Professor Yeom Heung-yeol of Soonchunhyang University noted that compromising a dual-key “multi-signature” security system exceeds the capabilities of ordinary attackers, suggesting involvement by a sophisticated state-sponsored entity such as Lazarus.
North Korean state-backed hackers are estimated to have stolen roughly 2.8 trillion won (approximately $2 billion) in virtual assets through various operations this year.
New evidence has also emerged suggesting that North Korea has been converting stolen digital assets into cash with assistance from Russian hacking groups. Forensic analysis indicates potential collaboration between these actors, including shared server infrastructure and similar operational techniques.
On November 25, Politico reported, citing cybersecurity firm ZenDigital, that technical markers reveal both Lazarus and Gamaredon, a Russia-based hacking group, made use of identical servers and similar methods. According to ZenDigital, such evidence points to a high likelihood of shared systems and leaves open the possibility of a cooperative relationship. The firm also cautioned that one group may have imitated the other’s tactics.
Michal Salat, Director of Threat Intelligence at ZenDigital, stated that this is “effectively the first time such direct indicators of technical exchange have been documented in the APT landscape,” noting that the findings suggest a level of potential state-to-state coordination not previously observed.
-
PREV [North Korea Inside]
-
NEXT [NK Focus]