North Korean animators are secretly working on major international animation series — Invincible by Amazon and Iyanu: Child of Wonder by HBO.
This information was uncovered by cybersecurity researcher Nick Roy, who has been scanning the North Korean Internet for years, reports WIRED.
The North Korean Internet is a small and restricted space. The repressive state has only 1024 IP addresses and about 30 websites that connect to the global Internet. Although there is a limited internal network, only a few thousand of the country’s 26 million residents can access the Internet.
But this is strictly controlled: you can only use the Internet for an hour and under the supervision of a person sitting nearby.
Therefore, the thousands of files found on North Korea’s misconfigured server can clearly demonstrate how an isolated country circumvents international sanctions.
This also comes at a time when U.S. officials are increasingly warning about North Korean IT workers infiltrating and outsourcing companies.
In December, Roy discovered a misconfigured cloud server on a North Korean IP address that contained thousands of animation files. He found a bunch of animations, videos, notes discussing the work, and changes that needed to be made to ongoing projects.
The server he found was updated daily.
The work is done on behalf of Chinese companies, and the materials found on the publicly accessible server contain editorial instructions translated into Korean. In one case, the report says, animator «was asked to improve the shape of the head of the character».
The researchers were able to identify some of the projects that the North Koreans worked on. These are:
The server also contained files from an unnamed Japanese anime series.
Some file names gave clues to the series and episode numbers. There were also files and projects that the researchers could not identify.
Sanctions imposed on the North Korean regime for its human rights abuses and nuclear programs prohibit U.S. companies from doing business with DPRK companies or individuals.
Representatives of Skybound Entertainment noted that they do not work with North Korean or Chinese companies and are not aware of any companies or individuals that could create content for Invincible.
It is likely that the North Koreans are working through China. The researchers were able to analyze connections to the open server and identified access from Spain and three Chinese cities.
«All three cities are known to have many North Korean-run businesses and are major centers for North Korean IT workers living abroad», — the report says.
According to Mandiant researcher Michael Barnhart, the purpose of such actions is to raise funds for the North Korean regime.
In early 2022, the FBI warned companies that North Korean freelance IT workers were infiltrating businesses to make money for the regime.
And increasingly, there are connections between North Korean IT workers and members of well-known hacker groups. These are often the same individuals.