Reconnaissance General Bureau

The Reconnaissance General Bureau (; RGB), part of the General Staff Department, is a North Korean intelligence agency that manages the state's clandestine operations. Most of their operations have a specific focus on Japan, South Korea, and the United States. It was established in 2009.

The RGB is regarded as North Korea's primary intelligence and clandestine operations organ. Although its original missions have traditionally focused on clandestine operations such as commando raids, infiltrations and disruptions, the RGB has since come to control most of the known North Korean cyber capabilities, mainly under Bureau 121 or its speculated successor, the Cyber Warfare Guidance Bureau.

It was headed at one time by Kim Yong-chol as the first head of the RGB.

History

It is the direct successor of the General Staff Department of the Korean People's Army's Reconnaissance Bureau () (which was responsible for several North Korean acts of espionage such as the 1996 Gangneung submarine infiltration incident). In addition, two former offices of the Central Committee of the Workers' Party of Korea (WPK) were moved into the Reconnaissance General Bureau, namely the WPK's External Investigations and Intelligence Department (), also known as Office 35, and the WPK's Operations Department, which was responsible for kidnapping foreign nationals during the Cold War.

The RGB was established in 2009 to consolidate various intelligence and special operations agencies of the North Korean government, meaning that units previously tasked with "political warfare, foreign intelligence, propaganda, subversion, kidnapping, special operations, and assassinations" were merged into one single organization.

In August 2010, an RGB agent posing as a defector was caught by South Korean police for planning to assassinate Hwang Jang-yop, who had defected from North Korea in 1997. The previous month two North Korean spies had been imprisoned for plotting to murder Hwang. North Korea denied involvement, but the later defector " Kim Kuk-song" said that he had personally directed the July 2010 operation. "Kim" also said "I can tell you that North Korean operatives are playing an active role in various civil society organisations as well as important institutions in South Korea.".

A defector, a former senior colonel known by the pseudonym Kim Kuk-song, whose identity has been verified by the BBC, had a senior position in the RGB until 2014, and revealed much information about the Bureau's activities in a 2021 interview with the BBC.

On October 31, 2017, two suspects were arrested by Public Security police in Beijing in an attempt to assassinate Kim Han-sol. They were part of a seven-man team sent by the RGB.

On November 12, 2021, an alleged RGB agent led an operation in Japan to illegally obtain foreign currency to shore up the North Korean economy by ordering two South Korean nationals to conduct a business that was against their official status of residence.

On February 15, 2022, an upcoming UN report mentions that the RGB is involved in running several service-related industries throughout Cambodia.

Cyberwarfare operational role

The foundations for North Korean cyber operations were built in the 1990s, after North Korean computer scientists returned from travel abroad proposing to use the Internet as a means to spy on enemies and attack militarily superior opponents such as the United States and South Korea. Subsequently, students were sent abroad to China to participate in top computer science programs.

The cyberwarfare unit was elevated to top priority in 2003 following the US invasion of Iraq.

Organization

The structure of the RGB is as follows as of 2021:

Command

Reconnaissance missions are also partially overseen by the General Staff Department (GSD) of the Korean People's Army (KPA). As of 2014, experts argued that "North Korea does not seem to have yet organized these units into an overarching Cyber Command."

The RGB appears to report directly to the National Defence Commission, as well as Kim Jong Un as the supreme commander of the KPA.

Methods

Until 2017, many North Korean spies were arrested in South Korea. But far fewer were arrested in the following years, apparently as the North started using new technologies rather than old-fashioned spying. In particular, high-profile defectors warned that Pyongyang had created a body of 6,000 skilled hackers.

North Korean remote worker infiltration scheme

The Reconnaissance General Bureau's department 53 has been involved in recruiting and training operatives for North Korea's large-scale remote worker infiltration scheme, which emerged around 2014 and significantly expanded during the COVID-19 pandemic. The RGB recruits top graduates from prestigious institutions such as Kim Chaek University of Technology and the University of Sciences in Pyongsong, training them in hacking techniques and foreign languages before deploying them as remote workers in Western companies under stolen identities. These operatives primarily target IT roles at US and European companies, using AI-enhanced interviews and deepfake technology to pass hiring processes, with individual workers earning an average of $300,000 annually that is funneled back to fund North Korea's weapons programs. The scheme has affected nearly every Fortune 500 company, generating millions in revenue while also enabling data theft and malware installation.

See also

* Glocom (defence company)

References

{{Authority control

Military intelligence agencies
North Korean intelligence agencies
General Staff Department of the Korean People's Army