PART I: The Closed State, Executions, Forced Labor, Women, Social Classification and the Security Apparatus
A System Designed for Control Rather Than Public Accountability
North Korea remained one of the most restrictive political systems in the world throughout 2025 and 2026.
The Office of the UN High Commissioner for Human Rights concluded in its 2025 ten-year assessment that the human-rights situation had worsened over the previous decade. The UN described a country in which people are heavily monitored, exploited and controlled, while surveillance, censorship, forced labor and severe punishment have expanded.OHCHR Seoul
Human Rights Watch similarly reported that the government maintained obedience through arbitrary imprisonment, torture, executions, collective punishment, forced labor and extreme restrictions on expression, assembly, religion and access to information.Human Rights Watch
North Korea's enforcement structure is fundamentally different from systems in which courts operate with even limited institutional independence.
Power is concentrated around the Workers' Party of Korea, the State Affairs Commission, the Ministry of State Security, the Ministry of Social Security, prosecutors, courts, military structures and Party organizations.
In practice, political security and judicial punishment are closely intertwined.
The Death Penalty in 2025 and 2026
North Korea does not publish a transparent national list of death sentences or executions.
Therefore, there is no independently verifiable nationwide figure for the number of people awaiting execution in 2026.
Any exact national death-row number would be speculative.
What can be established from UN reporting is that the scope of conduct punishable by death appears to have expanded.
The UN High Commissioner for Human Rights stated in September 2025 that public executions were reportedly being carried out for a broader range of offences than in the past, including economic crimes, drug trafficking, distribution of foreign media and offences regarded as hostile to the state. The UN noted that many such offences do not meet the international-law threshold for capital punishment.OHCHR Seoul
This is particularly significant because North Korean information-control legislation does not separate ordinary media consumption from political security in the way many legal systems do.
Accessing foreign entertainment or distributing external information can become a national-security issue.
Information Crimes and Severe Punishment
The government continued strengthening laws intended to prevent exposure to outside information.
The Anti-Reactionary Thought and Culture Law, Youth Education Guarantee Law and related controls form part of a broader system designed to suppress foreign media, especially South Korean films, television, music and language.
OHCHR's 2025 assessment reported that the use of the death penalty had expanded and that severe punishment increasingly applied to the distribution of foreign media.OHCHR Seoul
This transforms censorship into something far more severe than blocking websites.
In North Korea, possession, viewing, distribution and discussion of unauthorized information can create criminal exposure.
The state's information policy therefore operates through both technology and punishment.
There Was No Verified Nationwide Uprising in 2025–2026
Unlike Iran or some other authoritarian states examined in related reporting, North Korea did not experience a documented nationwide popular uprising in 2025 or 2026.
That distinction matters.
The country's repression system is designed to prevent collective mobilization before it becomes visible.
Independent organizations, political parties, trade unions, uncontrolled religious groups, mass social-media networks and unrestricted telecommunications do not exist as independent organizing spaces.
The absence of a nationwide uprising therefore should not automatically be interpreted as evidence of widespread political consent.
It exists within an environment where organizing itself is extraordinarily dangerous.
Forced Labor as a Structural Institution
Forced labor remained deeply embedded across North Korean society.
OHCHR stated that people continued to be compelled to perform labor through military service, detention institutions and state mobilization programs.OHCHR Seoul
Human Rights Watch also reported extensive forced labor and government mobilization schemes.Human Rights Watch
Forced labor has several functions simultaneously:
Economic production, political discipline, ideological conditioning and punishment.
Workers may be mobilized into construction, agriculture, mining, military-associated projects and state campaigns with little meaningful ability to refuse.
This makes labor policy part of the political-control system rather than simply an economic policy.
Songbun, Political Loyalty and Social Classification
North Korea continues to use the songbun socio-political classification system.
Human Rights Watch describes songbun as a system that ranks citizens according to perceived political loyalty and family background. People categorized lower in the hierarchy can face disadvantages in employment, residence, healthcare, education and access to state opportunities.Human Rights Watch
This is one of the most distinctive features of North Korean repression.
Political status may attach not merely to individual conduct but to family history and perceived loyalty.
That creates the possibility of intergenerational discrimination.
Women and Gender-Based Abuse
Women remain exposed to several overlapping forms of vulnerability.
The UN's 2025 assessment included allegations of widespread domestic violence, sexual coercion by officials, abusive body searches and sexual violence in detention.Human Rights Watch
Women engaged in market activity can also face particular exposure because informal commerce brings them into repeated contact with officials, police, border personnel and inspectors.
Where economic activity exists in legally uncertain or semi-tolerated spaces, officials gain discretionary power.
That creates conditions in which bribery, coercion and sexual abuse can occur with limited accountability.
Ethnic Minorities
North Korea is considerably more ethnically homogeneous than China, Russia or Iran.
There is therefore no comparable large-scale ethnic-minority dataset for 2025–2026.
The more important discriminatory categories are often political status, family background, disability, religion, defection history, repatriation status and perceived exposure to foreign influence.
Religious practice remains extremely restricted, while people returned from China can face interrogation, detention and severe punishment depending on their activities abroad.
The absence of large ethnic-minority populations does not mean discrimination is absent; it means the principal axes of discrimination are different.
Soldiers Sent to Russia
A major human-rights and security development involves North Korean soldiers deployed to support Russia's war effort.
Human Rights Watch reported allegations that wounded North Korean soldiers were sometimes killed by their own side and that troops had been instructed to commit suicide rather than be captured. North Korean state propaganda praised deaths framed as sacrificial loyalty.Human Rights Watch
By September 2026, Reuters reported Ukrainian claims that North Korea had already sent approximately 14,000 to 15,000 personnel to Russia since 2024 and was preparing additional deployments. Reuters also reported that North Korea supplied large quantities of artillery, missiles and rocket systems to Russia. These deployment figures were based substantially on Ukrainian and South Korean assessments and should therefore be attributed accordingly.Reuters
Two North Korean soldiers captured while fighting for Russia were transferred to South Korea in September 2026 after expressing a desire not to return to North Korea. Their cases underline the legal and human consequences of Pyongyang's overseas military deployment policy.Reuters
PART II: A Country Where the Public Internet Barely Exists, Smartphone Surveillance, Kwangmyong, Foreign Hardware and the Mechanics of Digital Containment
North Korea's Digital-Control Model Is Fundamentally Different
It is important not to copy the technical model used in reports on Iran, Russia or China.
North Korea does not primarily rely on filtering a broadly open public internet for ordinary citizens.
Instead, most ordinary users are prevented from accessing the global internet in the first place.
Domestic users typically access controlled telecommunications networks and the national intranet known as Kwangmyong, rather than unrestricted international connectivity. Freedom House noted that ordinary smartphone users can connect to a state-run intranet but not the global internet.Freedom House
This is more restrictive than conventional censorship.
China filters an enormous internet population.
Russia increasingly filters an internet population that historically enjoyed broad connectivity.
North Korea largely prevents the ordinary population from entering the global network at all.
Digital Isolation by Architecture
For most users, the basic model can be summarized as:
Domestic cellular network, controlled device, approved operating system, approved applications, state intranet, restricted content, no ordinary global internet access.
That architecture drastically reduces the need for national-scale censorship of every foreign service because ordinary users cannot reach those services through normal channels.
The state therefore controls access at the network edge, the operating system, the application layer and the physical-device level.
Smartphones as Surveillance Devices
One of the most important developments of 2025 and 2026 was continued expansion of smartphone use.
38 North reported in March 2026 that at least 24 North Korean smartphone brands were competing in the domestic market. The phones appear largely to originate with Chinese OEM manufacturers before receiving North Korean software and applications.38 North
The software architecture is heavily restricted.
North Korean phones use modified Android systems containing digital-signature controls that prevent installation or use of unauthorized applications and media.38 North
The control is therefore not simply located in routers.
It exists inside the user's device.
Trace Viewer
One of the most intrusive features is an application known as Trace Viewer.
38 North reported that the software periodically takes screenshots of user activity. Users can see that screenshots were taken but cannot view or delete the stored images.38 North
The psychological purpose is significant even when direct evidence of how every screenshot is reviewed remains limited.
A person using the phone must assume that prohibited activity could be recorded.
This creates a digital version of permanent uncertainty.
Government-Signed Content
North Korean smartphones employ a digital-signature mechanism that accepts only content and applications approved by the state.
That means even offline files can be controlled.
The device can refuse to open media that does not carry the appropriate government authorization.
This is technically different from DPI.
DPI examines traffic in transit.
North Korea can additionally enforce censorship after information reaches the device.
That makes the handset itself part of the censorship system.
Internet Cafés and Real-Time Monitoring
A 2025 account cited by 38 North described public computer facilities where machines could access Kwangmyong but not the external internet.
The facility reportedly recorded access and execution logs while administrators could monitor computer screens in real time and report politically problematic activity.38 North
This produces several layers of control simultaneously:
Identity, physical location, network access, session logging, screen observation and institutional supervision.
Radio-Wave Control and Device Registration
North Korea's Radio Wave Control Law was broadened to cover not only conventional radios but also computers, smartphones and other electronic devices.
38 North reported that covered equipment must undergo technical inspection and that purchasers are required to register devices with the government.38 North
This matters because information control begins before a device goes online.
The government regulates who can possess the equipment and what technical configuration it can use.
DPI: What Is Known and What Is Not
The user requested identification of specific DPI equipment.
The open-source record does not currently establish a complete inventory of North Korean DPI appliances comparable to documented systems in China or Russia.
There is evidence of severe network segmentation, controlled routing, application whitelisting, domestic intranets, device-level cryptographic approval and extensive monitoring.
But there is not sufficient reliable public evidence to state that a named DPI appliance model performs nationwide censorship of ordinary civilian internet traffic.
That is partly because North Korea's architecture often makes such filtering unnecessary.
If ordinary citizens are never given unrestricted international routing, the state can prevent access upstream before a foreign protocol ever needs to be selectively blocked.
Encryption and VPNs
For an ordinary North Korean smartphone user, the central obstacle is not whether OpenVPN, WireGuard or another encrypted protocol can evade DPI.
The user generally lacks unrestricted international routing in the first place.
A VPN requires a path to an external VPN server.
If the subscriber is confined to domestic networks and approved services, there may be no routable path to establish that connection.
This is a stronger form of digital containment than simply recognizing a VPN handshake.
Chinese Hardware in the Smartphone Ecosystem
The hardware supply chain is much clearer.
38 North reported that North Korean smartphones are believed to originate primarily from Chinese manufacturers or OEM producers, while North Korean entities install domestically controlled software.38 North
This is an important example of localization.
Foreign hardware, North Korean operating controls, North Korean applications, North Korean content policies.
It does not follow that the Chinese OEM manufacturer necessarily designed or knowingly supplied the censorship layer.
The hardware and the repression software must be attributed separately.
Hardware Forensics
A serious investigation into North Korean telecommunications equipment should document:
Manufacturer, motherboard model, SoC, modem chipset, baseband version, IMEI structure, MAC address, OUI, serial number, manufacturing date, firmware image, operating-system build and importer markings.
Those identifiers can then be matched against:
Chinese OEM catalogs, export records, distributors, logistics companies, customs declarations, freight manifests and North Korean import entities.
Because North Korea obscures trade data, serial-level evidence becomes unusually important.
Physical International Connectivity
North Korea's external internet connectivity is narrow relative to its population and has historically depended heavily on connections through China and, later, Russia.
Public routing observations have identified international connectivity involving Chinese and Russian upstream networks.
However, the open-source evidence does not provide a complete public map of exact intelligence interception rooms, military-controlled border cabinets or individual filtering racks.
Claims identifying a specific physical building as a state interception site require:
Router configurations, facility photographs, procurement documents, internal network diagrams, engineering testimony or equipment serial numbers.
Without such evidence, precise physical attribution should not be presented as established fact.
PART III: The Hidden Economy, China Trade, Russian Military Exchange, Crypto-Theft, IT Workers and Sanctions-Evasion Infrastructure
North Korea Does Not Have a Normal E-Commerce Economy
Quarterly "e-commerce blackout losses" cannot be calculated for North Korea in the same way they might be modeled for Russia or Iran.
There is no open nationwide consumer internet market comparable to Amazon, Alibaba, Instagram commerce or ordinary cross-border online retail.
For most citizens, the global internet is already unavailable.
Therefore, there is no credible national dataset showing:
Q1 internet-blackout e-commerce losses, Q2 losses, Q3 losses or Q4 losses.
Publishing invented quarterly figures would be misleading.
North Korea's emerging digital economy instead includes controlled electronic payments, domestic applications, state-linked shopping systems and internal services.
38 North reported that smartphones increasingly support functions such as medicine delivery, electronic shopping and ration-related services.38 North
Economic Recovery Does Not Mean Household Security
38 North reported, citing South Korea's Bank of Korea, that North Korea's GDP expanded by an estimated 3.5 percent in 2025, marking a third consecutive year of growth. The estimate attributed the improvement partly to expanded cooperation with Russia, revived trade with China and state industrial projects.38 North
But the 2026 picture remained unstable.
38 North reported that during the first half of 2026 the North Korean won sharply depreciated, with the unofficial dollar exchange rate rising from roughly 37,250 won in January to about 70,800 in May before easing. Prices of rice, corn, gasoline and diesel approximately doubled in won terms.38 North
This is a critical distinction.
A state can show aggregate industrial growth while households experience currency instability and rising food and fuel prices.
China Remains the Commercial Lifeline
China remained North Korea's dominant trade partner.
Reuters reported that bilateral trade during January and February 2026 increased 22 percent year on year to $418.7 million.
Chinese exports to North Korea reached $329.5 million, while Chinese imports from North Korea rose to $89.2 million.Reuters
The relationship therefore remains economically decisive.
North Korea can deepen military dependence on Russia while still depending heavily on China for ordinary trade.
Tungsten and Foreign Exchange
One of the more unusual economic developments of 2026 involved tungsten.
38 North reported that North Korean exports to China rose 68 percent during January to May 2026 to approximately $287 million, with much of the increase associated with tungsten ore.
Tungsten exports rose from approximately $9 million during the comparable previous period to approximately $88 million.38 North
This produced a temporary foreign-exchange windfall while the domestic currency was losing value.
Russia as a Military-Economic Partner
North Korea's relationship with Russia has moved far beyond diplomatic symbolism.
The Multilateral Sanctions Monitoring Team's first report, transmitted to the UN in May 2025, focused on alleged unlawful military cooperation between Russia and North Korea, including arms transfers and Russian training of North Korean troops.Digital Library
The monitoring group reported that Russia had supplied North Korea with military support including a Pantsir air-defense system and electronic-warfare equipment after North Korean troop deployment.en.yna.co.kr
Meanwhile North Korea supplied Russia with artillery, missile systems and personnel.
By September 2026, Reuters reported Ukrainian assertions that Pyongyang was preparing potentially another 10,000 troops for deployment.Reuters
North Korea and the Iron Triangle
The Iron Triangle in this analytical framework remains:
China, Russia, Iran.
North Korea remains outside it.
Its connection differs by state.
Russia: deep and direct military relationship, including troops, munitions, training and technology exchange.Digital Library
China: dominant commercial relationship, major supply route, source of manufacturing hardware and geographic economic lifeline.Reuters
Iran: a history of suspected or documented missile-related cooperation exists, and Reuters noted continuing expert concern regarding missile-development links, but the public evidence of a 2025–2026 operational relationship is considerably thinner than the North Korea-Russia relationship.Reuters
North Korea should therefore not be treated as a fourth "corner."
A more accurate model is:
Iron Triangle: China, Russia, Iran External strategic node: North Korea
Crypto Is Not a Peripheral Revenue Source
North Korea presents one of the clearest cases in the world of a government-linked cyber apparatus using digital assets as a revenue and sanctions-evasion mechanism.
U.S. Treasury sanctions and Justice Department cases repeatedly connect North Korean state-linked entities, the Reconnaissance General Bureau and overseas IT-worker programs to cryptocurrency theft and laundering.U.S. Department of the Treasury
The $7.74 Million Forfeiture Case
In June 2025, the U.S. Justice Department filed a civil forfeiture action targeting more than $7.74 million in digital assets allegedly generated and laundered through North Korean IT workers for the benefit of the North Korean government.Department of Justice
The 2026 U.S. National Proliferation Financing Risk Assessment described laundering techniques including:
Structured transfers, chain hopping, token swapping, NFT purchases, fictitious accounts, commingling and use of U.S.-based online accounts.U.S. Department of the Treasury
These are exactly the techniques crypto-forensic investigations must reconstruct.
USDT and Stablecoins
North Korean networks have used stablecoins.
The Justice Department previously alleged that IT-worker networks requested payment in assets including USDT and USDC and funneled the proceeds through laundering networks associated with Foreign Trade Bank representatives.Department of Justice
The important point is that North Korean crypto activity should not be reduced to Bitcoin theft.
Stablecoins can be useful because they avoid Bitcoin's price volatility while preserving cross-border transferability.
$5.3 Million Managed for First Credit Bank
In November 2025, Treasury sanctioned North Korean bankers and institutions involved in laundering cybercrime and IT-worker proceeds.
Treasury stated that two North Korean bankers had helped manage funds including approximately $5.3 million in cryptocurrency for First Credit Bank, with part of the funds linked to a DPRK ransomware actor and IT-worker revenue.U.S. Department of the Treasury
OFAC also updated the bank's sanctions entry to include cryptocurrency-address information.
This is especially valuable for investigators because an official sanctions attribution can be used as a starting point for blockchain mapping.
IT Workers Inside Western Companies
This may be North Korea's most direct economic penetration vector into Western business infrastructure.
Treasury reported in March 2026 that government-orchestrated North Korean IT-worker programs systematically defrauded American companies and had generated nearly $800 million in 2024 for North Korean weapons programs.U.S. Department of the Treasury
These workers commonly use:
Stolen identities, fabricated résumés, false nationalities, proxy accounts, remote-access software and U.S.-based laptop farms.
The danger is not merely payroll fraud.
Once hired, a malicious worker may acquire access to source code, cloud systems, internal communications, client information, credentials and proprietary business data.
Laptop Farms Inside the United States
The threat is no longer theoretical.
In April 2026, two U.S. nationals were sentenced for operating infrastructure that allowed North Korean remote workers to appear as though they were physically located in the United States.
The scheme used identities of at least 80 U.S. persons and generated more than $5 million for North Korea.Department of Justice
Additional defendants were sentenced in May 2026 for hosting company laptops used by North Korean workers.Department of Justice
This is a highly specific counterintelligence vulnerability.
An American company may believe it has hired a software engineer in New York or California while the real worker is operating abroad under a stolen identity.
China and Russia as IT-Worker Operating Environments
Treasury stated that thousands of North Korean IT workers operate internationally, particularly from China and Russia.U.S. Department of the Treasury
A 2025 Treasury action specifically targeted a Russia-based network.
Another Treasury designation identified Korea Mangyongdae Computer Technology Company as operating IT-worker delegations from Shenyang and Dandong in China.U.S. Department of the Treasury
These cases provide concrete evidence of how North Korean revenue networks intersect with Russia and China.
Drugs and Arms
North Korea has historical allegations and sanctions cases involving illicit trade, arms sales, smuggling and other clandestine revenue channels.
But the strongest fresh 2025–2026 open-source evidence centers on:
Military exports to Russia, cyber theft, cryptocurrency laundering, fraudulent IT work and sanctions evasion.
It would therefore be misleading to characterize narcotics as the dominant documented North Korean state-financing mechanism during this specific reporting period without stronger contemporary evidence.
The current evidentiary record is much stronger for cyber and weapons-linked revenue.
PART IV: Western Exposure, Remote Work Infiltration, Cyber Risk, Data Access and North Korea's Position Outside the Iron Triangle
The New North Korean Threat Does Not Require a Border Crossing
A traditional intelligence model focuses on diplomats, recruited spies and clandestine agents physically entering a target country.
North Korea has demonstrated another method.
Its personnel can penetrate a Western company without physically entering the United States or Europe.
A stolen identity, remote interview, U.S.-based laptop, residential proxy and legitimate corporate VPN may be enough.
That changes the security problem fundamentally.
The Remote Worker as an Access Vector
A fraudulent developer hired into a company may receive legitimate access to:
Source-code repositories, GitHub organizations, AWS or Azure environments, internal Slack channels, databases, test credentials, customer records, software-signing systems and development pipelines.
Treasury warned in 2026 that North Korean IT workers had weaponized access to sensitive information and extorted employers.U.S. Department of the Treasury
This threat is especially serious because the attacker begins with legitimate credentials rather than breaking through a firewall from outside.
U.S. Businesses Already Targeted
The Justice Department has prosecuted multiple facilitators of North Korean IT-worker operations.
Cases involved Fortune 500 companies, defense contractors, blockchain companies and technology businesses.Department of Justice
The schemes used stolen identities and real computers physically located inside the United States.
That is a documented form of institutional penetration.
It does not justify treating Korean students, refugees, immigrants or workers generally as security threats.
The relevant indicators are fraudulent identity, hidden location, sanctions-linked payment flows, unauthorized remote access and demonstrable DPRK direction.
Europe Faces the Same Vulnerability
European businesses face the same structural exposure.
Remote recruitment has become international.
A company in London, Berlin, Amsterdam or Paris can hire a person claiming to be located in another jurisdiction without ever meeting that person physically.
If identity verification is weak, the company may unknowingly grant access to a DPRK-linked worker.
The most effective countermeasures include:
Live identity verification, device attestation, geolocation consistency checks, payroll-beneficiary verification, sanctions screening, source-code access segmentation, privileged-access monitoring and investigation of unexplained remote-control software.
Crypto-Theft Can Produce Strategic Revenue
North Korea's cyber apparatus has repeatedly targeted financial and cryptocurrency institutions.
The country's advantage is asymmetric.
It does not need an economy the size of the United States to impose billion-dollar risks on global financial systems.
A small number of technically skilled units can target exchanges, software companies and financial infrastructure internationally.
Cyber theft therefore acts as both:
Crime and state revenue generation.
The Reconnaissance General Bureau
U.S. authorities identify the Reconnaissance General Bureau as North Korea's primary intelligence and clandestine-operations organization and associate it with cyber groups including Lazarus Group and APT38.Department of Justice
This linkage matters because the boundary between intelligence activity and financial cybercrime becomes unusually blurred.
In North Korea's case, stealing cryptocurrency can serve national-security objectives by generating foreign currency for state priorities.
Ransomware
North Korean-linked cyber actors have also been associated by U.S. authorities with ransomware activity.
Treasury's November 2025 action linked part of a $5.3 million crypto pool to a DPRK ransomware actor.U.S. Department of the Treasury
A ransomware payment can therefore become part of a chain extending from:
Victim company, cryptocurrency payment, intermediary wallet, exchange, laundering entity, sanctioned bank or state-linked recipient.
Crypto-forensics is essential because the blockchain can preserve parts of that chain even when identities are initially concealed.
Humanizing Digital Isolation
North Korea offers a different version of "digital blackout."
For much of the population, the blackout is not temporary.
It is structural.
Ordinary people live for years without normal access to the international internet.
That means students cannot freely search global research databases; doctors cannot independently consult unrestricted foreign resources; entrepreneurs cannot communicate normally with overseas customers; families cannot use ordinary international messaging; journalists cannot publish independently.
The humanitarian cost is therefore cumulative rather than episodic.
Healthcare and Digital Isolation
As North Korea places more domestic services online, including medicine-related services reported by 38 North, internal digital systems become increasingly important to ordinary life.38 North
Network interruption or administrative restriction can therefore affect access to information and services.
But there is insufficient publicly verified evidence to claim that a particular 2025 or 2026 North Korean internet restriction directly caused a documented number of hospital deaths.
The responsible conclusion is that information isolation and fragile infrastructure can create healthcare risks, particularly where medical professionals lack unrestricted access to current international information.
Sensitive Data and Outsourced Services
The wider concern about companies handling medical, identity or professional data is legitimate, but the North Korean evidence differs from the Russia and China cases.
There is no reliable open-source evidence establishing a broad North Korean-controlled international medical-interpretation network operating inside U.S. hospitals.
Such a claim should therefore not be inserted into this report as fact.
The documented North Korean access model is instead more concrete:
Fraudulent remote employment inside Western companies.
That route can expose corporate data without requiring speculative claims about unrelated medical vendors.
The Iron Triangle and North Korea
North Korea's geopolitical position should be drawn carefully.
The Iron Triangle remains:
China, Russia, Iran.
North Korea is a connected strategic node, not a fourth side.
Its strongest current connection is with Russia.
China remains its primary trade partner and a crucial location for North Korean overseas economic operations.
Iran remains relevant through historical missile and security ties, but 2025–2026 open-source evidence of operational cooperation is less extensive than the Russia relationship.Reuters
The network therefore does not form a square.
It is better visualized as a triangle with an external node connected most strongly to two of its vertices.
September 2026: The Russia Connection Is Still Deepening
The newest developments reinforce that assessment.
Reuters reported on September 28, 2026 that Ukrainian President Volodymyr Zelenskiy said more than 8,000 North Korean troops remained in Russia and another 10,000 were being prepared for deployment.Reuters
Whether every projected deployment occurs remains uncertain.
But the military relationship is no longer speculative.
North Korean personnel, weapons and Russian technology transfers have become part of a documented wartime relationship.
The Risk to Europe
North Korea affects European security through several pathways:
Support for Russia's war effort, weapons transfers, sanctions evasion, cyber theft, remote IT-worker fraud and access to cryptocurrency infrastructure.
A North Korean artillery round transferred to Russia has a direct European security consequence.
So does revenue stolen from a European cryptocurrency company if the proceeds support sanctioned state programs.
The geographic distance between Pyongyang and Europe therefore no longer defines the security distance between them.
The Risk to the United States
For the United States, one of the most immediate North Korean vulnerabilities is inside the private sector.
A fraudulent worker can be hired into an American company, a U.S. resident can unknowingly or knowingly host the laptop, salaries can be converted into cryptocurrency and the proceeds can be transferred through laundering networks.
Treasury and Justice Department cases demonstrate that this model has already operated at scale.U.S. Department of the Treasury
North Korea does not need to send thousands of physical operatives into the United States to create access.
In the remote-work era, the network connection can become the border crossing.
Final Assessment
North Korea's 2025–2026 control system is unlike those examined in other authoritarian states.
It does not primarily depend on managing a population that already possesses unrestricted internet access.
It begins from exclusion.
The public is largely separated from the global internet; smartphones are digitally locked; unauthorized content can be rejected at device level; activity may be recorded locally; radio and electronic equipment are registered; foreign media can trigger extreme criminal punishment; social status is tied to political loyalty; labor can be compulsory; and military service increasingly serves international strategic relationships.
Outside the country, the model changes completely.
The same state that prevents ordinary North Koreans from using the global internet operates sophisticated international cyber, cryptocurrency and remote-work networks across it.
That contradiction is central to understanding modern North Korea.
Citizens are denied the global network, while state-linked operators exploit it internationally.
Economically, China remains essential.
Militarily, Russia has become increasingly central.
Financially, cryptocurrency and deceptive remote employment provide alternative revenue channels.
Strategically, North Korea sits outside the China–Russia–Iran Iron Triangle while intersecting with its broader security environment.
The investigative priority should therefore be concrete rather than rhetorical:
Follow the weapons shipments, follow the Russian technology transfers, follow the Chinese hardware supply chain, follow the overseas IT-worker identities, follow the laptop farms, follow the crypto addresses, follow the sanctioned banks and preserve the transaction trail.
Sources and Reference Material
Human Rights Watch, World Report 2026: North Korea
Freedom House, North Korea: Freedom in the World 2025
38 North, The Big Expansion of North Korea's Cellular Sector, March 18, 2026
38 North, North Korea's Revised Radio Wave Control Law, July 8, 2025
38 North, NK TechLab Law Database, July 2025
38 North, North Korea's Smartphone Market and Surveillance Controls
38 North, North Korea's Economy, First Half 2026
38 North, North Korea's New Five-Year Economic Plan, August 2026
Reuters, China-North Korea Trade Rises 22 Percent, March 20, 2026
Government of the Netherlands, MSMT Statement on DPRK-Russia Military Cooperation
Reuters, North Korea Preparing Additional Troops for Russia, September 28, 2026
U.S. Treasury, DPRK IT Worker Fraud Targeting U.S. Businesses, March 12, 2026
U.S. Treasury, DPRK Bankers and Cybercrime Laundering Networks, November 4, 2025
U.S. Treasury, DPRK IT Worker Networks in China and Russia, July 8, 2025
U.S. Department of Justice, $7.74 Million DPRK Crypto Forfeiture Case, June 5, 2025
U.S. Department of Justice, North Korean IT Worker Sentencings, May 6, 2026
U.S. Department of Justice, North Korean Cryptocurrency Theft Scheme, June 30, 2025
U.S. Treasury, DPRK Digital-Asset Money-Laundering Network
U.S. Treasury, 2026 National Proliferation Financing Risk Assessment
Reuters, North Korea Condemns U.S. Strike on Iran and Background on DPRK-Iran Missile Cooperation
Research, investigation, compilation and preparation by the Editorial Team.
