AGP Executive Report

Nuclear Diplomacy Push: South Korea’s President Lee Jae Myung urged the U.S. to trade sanctions relief for a North Korea nuclear freeze, arguing “denuclearisation first” is unrealistic and proposing a phased “stop, reduction and dismantlement” path ahead of the UN General Assembly. Trilateral Pressure: South Korea, the U.S. and Japan reiterated their “resolute” commitment to North Korea’s complete denuclearization and urged Pyongyang to resume dialogue, while also stressing stability across the Taiwan Strait and opposing “economic coercion.” Weapons Update: North Korea said it tested a new “great significance” weapons system, with photos suggesting a hypersonic missile, as South Korea detected two short-range launches in succession. Sanctions Monitoring & Labor: Pyongyang rejected a sanctions-monitoring report on overseas workers, calling monitors “illegal,” while Seoul, Washington and Tokyo highlighted the multilateral sanctions monitoring team’s work. Cyber & Crypto Threats: North Korea-linked hackers continued targeting global job seekers via fake interviews and coding tests, with a joint advisory citing 30,000 compromised devices and at least $10.71m stolen in cryptocurrency. Russia Link via Trade Route: A new Russia-DPRK bridge and upgraded border crossing in Primorye are set to speed logistics into Russia’s interior and toward ports, reinforcing growing connectivity.

Missile Signaling: North Korea fired two short-range ballistic missiles from Wonsan toward the East Sea, with South Korea’s JCS preliminarily linking the first to the Hwasong-11 series and noting ranges of about 450 km and over 600 km—another marker of a faster, more varied tactical missile tempo. Market Watch: Jangmadang rice prices in Pyongyang and other regions fell in mid-September as holiday supply boosted grain availability and eased demand. Overseas Labor Dispute: Pyongyang rejected a U.S.-led sanctions monitoring report, calling the watchdog “illegal” and insisting its overseas worker program is legitimate, while the report estimates tens of thousands of workers abroad and links earnings to nuclear and missile funding. Cybercrime & Crypto Theft: WaterPlum/“Contagious Interview” campaigns stole at least $10.7M in crypto and compromised 30,000+ devices in 100+ countries by posing as recruiters and using fake technical interviews. Cyber Infrastructure Leak: A “Hangro” TLS certificate exposure reportedly revealed sensitive VPN-related infrastructure details tied to North Korea and Russia, underscoring operational security risks. Diplomacy Signals: Former U.S. envoy Stephen Biegun said Trump could propose talks with Kim Jong-un in Pyongyang after APEC, while Seoul’s unification minister met Biegun to discuss a possible reset in inter-Korean and U.S.-NK engagement.

Missile Watch: North Korea fired two suspected short-range ballistic missiles off its east coast within about three hours, with the first traveling roughly 450 km and the second over 600 km, landing outside Japan’s EEZ; Seoul and Tokyo condemned the launches as violations of UN rules and held emergency security meetings. Agriculture & Targets: Pyongyang urged timely completion of the rice harvest, calling it the “first sector” to show results under its five-year economic plan and crediting mechanization for better output. Cybercrime & Finance: A North Korea-linked hacking group, WaterPlum (aka “Contagious Interview”), used fake job interviews to infect 30,000 devices in 100+ countries, compromise 7,000 crypto wallets, and steal at least $10.7M, with Japan, the US, Australia, Germany and others issuing a joint advisory. Party Line Shift: North Korea reportedly revised party rules at its congress, dropping an 80-year unification pledge while expanding Kim Jong-un’s authority and military posture. Cross-border Trade Links: Russia and North Korea opened a new road bridge across the Tumen River, improving year-round logistics and signaling deeper economic ties.

Missile Tests: North Korea fired two short-range ballistic missiles toward the East Sea/Sea of Japan from the Wonsan area, with South Korea and Japan tracking flights of about 450 km and 600+ km; Japan said the projectiles fell outside its EEZ and lodged a protest as Seoul convened an emergency NSC meeting. Nuclear Politics: The launches come amid Pyongyang’s rejection of UN nuclear watchdog criticism and its insistence it will keep strengthening its nuclear deterrent, with Kim Yo Jong blaming US-led drills for “ever-worsening” tensions. Cyber & Finance: Separate reporting highlights the WaterPlum/“Contagious Interview” operation, using fake job interviews to infect 30,000 devices in 100 countries, compromise 7,000 crypto wallets, and steal about $10.71m—linking the scheme to DPRK weapons-related oversight. Russia Link: A new Russia–North Korea road bridge over the Tumen River is framed as a trade-and-logistics boost that also signals deeper strategic alignment between Moscow and Pyongyang. Diplomacy & Investment: South Korea’s FM Cho Hyun met US Secretary of State Marco Rubio, stressing progress on US investment talks and positioning Seoul as a “pacemaker” for restarting dialogue with North Korea.

Cybercrime & Finance: Japan’s National Police Agency says North Korea-linked WaterPlum (Contagious Interview) infected 30,000+ devices in 100+ countries, stealing crypto worth about $10.71m (¥1.7b) by posing as corporate headhunters and sending malware disguised as technical job interviews. Cyber Tactics: Separate warnings highlight a broader shift: attackers increasingly hide malware command instructions on public blockchains, making takedowns harder because the data sits on-chain. Defense Industry: Kim Jong Un inspected major munitions factories and ordered expanded artillery output and modernization, pushing AI and automation across the defense sector. Diplomacy & Trade: South Korea’s Foreign Minister Cho Hyun met U.S. Secretary of State Marco Rubio, seeking “substantive” support for freedom of navigation in the Strait of Hormuz while pressing for smooth execution of Seoul’s $350bn U.S. investment pledge. Labor & Human Cost: Reporting describes North Korea’s economy relying on extracting revenue from citizens at home and abroad, including supplying troops and labor tied to Russia’s war effort.

Defence Industry: Kim Jong Un inspected major munitions enterprises and ordered expanded artillery output and modernization, explicitly pushing AI and automation upgrades. Cybercrime & Finance: Japan’s NPA and the FBI say North Korea-linked WaterPlum (aka “Contagious Interview”) used fake tech recruiter offers to infect 30,000+ devices in 100+ countries, steal credentials from 7,000 crypto wallets, and move at least ¥1.7bn to accounts tied to Pyongyang. Cyber Tactics: Chainalysis warns malware operators are increasingly using public blockchains as resilient “dead drops,” storing command-and-control instructions on-chain so defenders can’t simply shut servers down. Russia-Ukraine Supply Chain: Reports say North Korea is sending large numbers of workers to Russia’s Alabuga drone factory, raising questions about whether Pyongyang will receive drones or production know-how. Diplomacy & Business: South Korea’s Cho Hyun and US Secretary of State Marco Rubio agreed to coordinate for “good” outcomes on Seoul’s $350bn US investment pledge, while also discussing North Korea dialogue efforts.

US-South Korea Investment & Hormuz Talks: Foreign Minister Cho Hyun met US Secretary of State Marco Rubio in Washington, reaffirming Seoul’s willingness to help restore free navigation through the Strait of Hormuz while ruling out troop deployment that could pull South Korea into the Iran war; the pair also pushed for faster execution of Seoul’s $350bn US investment pledge under last year’s trade deal. North Korea-Russia War Partnership: A new analysis highlights how Russia and North Korea have deepened military cooperation since 2022, with Pyongyang sending munitions, missiles and troops to Russia—while sanctions pressure and UN monitoring remain contested. Kim Jong Un’s Weapons Modernization: Kim inspected major munitions factories and urged expanded output and upgrades to weapons production, including AI and automation. North Korea Cybercrime for Crypto: Japan, the US, Australia and Germany publicly attributed the WaterPlum “Contagious Interview” hacking operation to North Korea, saying it hit 30,000 PCs in 100+ countries and stole at least $10.7m from 7,000+ crypto wallets, often via fake job offers. North Korea’s Overseas Labor Revenue: Multiple reports point to North Korea’s overseas worker network generating up to $800m a year, despite sanctions and growing scrutiny. Domestic Control via Language Crackdown: North Korea’s constitutional push to protect “Pyongyang Cultural Language” is driving a renewed crackdown on “puppet speech” in schools and workplaces.

South Korea-Iran Standoff: President Lee Jae Myung said Seoul will not deploy troops or military assets in a way that “involves or enters war” in Iran, even as it weighs limited steps to protect commercial shipping and crude routes near the Strait of Hormuz. US-ROK Talks & Investment: Lee’s remarks came as top diplomats Cho Hyun and U.S. Secretary of State Marco Rubio met in Washington to discuss Hormuz security, a stalled U.S. investment package, and possible cooperation on North Korea diplomacy. North Korea Cybercrime, Big Numbers: Japan’s NPA says the DPRK-linked WaterPlum campaign used fake recruiter job offers to infect 30,000+ devices and steal crypto credentials from 7,000+ accounts, moving at least 1.7 billion yen. On-Chain Malware Trend: Chainalysis reports malicious instructions on public blockchains jumped 440% in a year, with state-linked groups—including North Korea—using “blockchain dead drops” to make takedowns harder. North Korea-Russia Labor Link: A sanctions monitoring team says up to 25,000 North Koreans work in Russia’s drone industry, often under “student” visas, with earnings largely confiscated by Pyongyang. UN Sanctions Oversight Blocked: Russia and China vetoed a UN Security Council bid to extend sanctions-monitoring experts for Iran, keeping the sanctions in place while tightening oversight.

DPRK Cyber & Crypto Crime: Chainalysis reports a 420% jump in on-chain malware infrastructure over the past year, with state-linked actors driving most of the activity; North Korea-linked groups are tied to campaigns across Tron, Aptos and BNB Smart Chain, using “blockchain dead drop” tactics that keep malicious instructions hard to erase. Overseas Labour Revenue: Multiple reports say North Korea’s overseas worker network is generating up to $800m a year, underscoring how sanctions pressure is being routed into cashflows that can support strategic programs. Sanctions Pressure & Finance Evasion: The US sanctioned Iran-linked crypto exchange BitBank over alleged processing of “Hormuz Safe” Bitcoin payments tied to IRGC-linked schemes, highlighting how digital rails are becoming a battleground for sanctions enforcement. Diplomacy Signals for the Koreas: A former US diplomat says China is unlikely to block US–North Korea diplomacy but also won’t be a “central” player, suggesting any thaw will be driven mainly by Washington and Pyongyang. Human Impact at Home: In North Hamgyong’s Musan county, officials failed to persuade parents of a bullied disabled student to return the child to school, showing how social pressure can derail education despite state outreach. Maritime Incident: A boat towed by a North Korean cargo ship sank off Japan’s northwest coast; Japan Coast Guard rescued three and is investigating links to the vessel.

North Korea’s sanctions-busting labor pipeline: A UN-linked monitoring report says Russia is using up to 25,000 North Koreans in drone production, including at Alabuga (Tatarstan), with workers often entering on “student” visas to dodge UN rules; the scheme is estimated to have generated as much as $800m for Pyongyang in 2025, feeding its nuclear and missile programs. Cybercrime via public blockchains: Blockchain analytics firm Chainalysis reports a 420% surge in state-linked hackers writing malware instructions on public blockchains, with North Korea- and Iran-linked groups among the main actors; the report warns that blockchain “dead drops” can keep malicious commands accessible even after domains or servers are taken down. Inter-Korean legal tightening: South Korea’s Constitutional Court upheld a requirement for Unification Minister approval to bring goods from North Korea, citing the “sensitivity” of inter-Korean relations. Diplomacy signals: Unification Minister Chung Dong-young said dialogue can’t start with denuclearization as a precondition, while a South Korean government move supports easing rules on civilian contact with North Koreans. Regional security context: Ukraine’s president said North Korea is gaining modern combat experience through Russia, while accusing China of leaning politically toward Moscow rather than pushing for talks.

Overseas Labor Cashflow: A UN-linked sanctions monitoring team says North Korea kept sending workers abroad in 2025 despite bans, with an estimated 35,600–101,280 people in at least 17 countries and earnings of about $450m–$800m; most money is reportedly confiscated by Pyongyang and some is routed via sanctioned banks and trading firms tied to military procurement, including in Russia’s drone sector. Court-Ordered Damages: South Korea’s court ordered North Korea to pay more than W44.6bn (about $32.5m) for destroying the inter-Korean liaison office in 2020, marking a rare ruling that treats the act as infringement of South Korean state property rights. Drug Crackdown Impact: Daily NK reports North Korea’s intensified meth crackdown along the China border has squeezed distribution networks and pushed “bingdu” prices sharply higher as bribery routes face tougher scrutiny. Diplomacy Watch: South Korea’s FM Cho Hyun heads to Washington for talks with U.S. Secretary of State Mark Rubio, with North Korea on the agenda alongside investment and Hormuz-related security issues. Denuclearization Skepticism: A former U.S. official says a Trump-Xi summit may “talk the talk” on North Korea but is unlikely to deliver much, given China’s interest in keeping Pyongyang closer and away from the U.S. orbit. Regional Security Context: North Korea’s meth and overseas labor stories are unfolding alongside heightened military pressure in the region, including recent missile activity after U.S.-Japan-South Korea drills.

Overseas Labor Revenue: A UN-linked sanctions monitoring report says North Korea still deploys 35,600–101,280 workers abroad in at least 17 countries, generating an estimated $450m–$800m in 2025, with most in China (20,000–70,000) and Russia (15,000–30,000), and with proceeds tied to nuclear and ballistic-missile funding. Sanctions Evasion Pressure: Participating states say the network is a “systemic evasion” of UN Security Council bans and point to visa and program loopholes, plus heavy wage seizures that leave workers indebted. Inter-Korean Legal Fallout: A Seoul court ordered Pyongyang to pay about $32.5m (44.6bn won) for blowing up the 2020 Inter-Korean Liaison Office in Kaesong—an unprecedented state-to-state damages move, though payment is seen as unlikely. Trade Access Tightening: North Korea has barred Western and Chinese visitors from an upcoming Pyongyang trade fair, citing Ebola-related border restrictions, reversing a limited spring reopening. Regional Resource Deals: South Korea and five Central Asian countries agreed to deepen cooperation in critical minerals and energy, aiming to build shared value chains that expand supply links and jobs. Defense-Industry Context: Separate reporting highlights Japan’s push to build large missile cruisers amid China, Russia and North Korea threats, underscoring how security spending keeps reshaping regional procurement priorities.

Inter-Korean Legal Fallout: A Seoul court ordered Pyongyang to pay 44.6 billion won (about US$32.5m) in damages for blowing up the Inter-Korean Liaison Office in Kaesong in 2020, marking the first time South Korea has pursued damages directly against the North; Seoul says it will review follow-up steps, while experts doubt Pyongyang will ever pay. North Korea’s “Leisure Boom” Economy: Reuters reports a surge in imports of massage equipment, treadmills, pianos and even bumper cars, alongside new resorts and luxury retail, as Kim Jong Un channels consumption through state-controlled networks to tighten control and generate revenue. Russia Ties Deepen: Kim Jong Un vowed to “expand and deepen” cooperation with Russia and backed Putin’s “sacred war,” as Pyongyang continues sending troops to support Moscow. Diplomacy & Investment Talks: South Korea’s top diplomat Cho Hyun is set to meet U.S. Secretary of State Marco Rubio in Washington this week, with economic cooperation and the Strait of Hormuz expected alongside North Korea nuclear issues. Local Industry Pressure: North Hamgyong launched a design contest for light-industry factories, but workers complain the rules are forcing even general labor to submit designs, adding strain to already tight production. AI Safety Alarm: A debate over AI extinction risk resurfaced after Anthropic-linked warnings, with concerns ranging from cyberattacks to biological weapons design.

North Korea-Russia Military Ties: Kim Jong Un sent Vladimir Putin a letter pledging “invariable support” and calling Russia’s war in Ukraine “sacred,” while promising to “expand and deepen” joint work—amid reports Pyongyang has already deployed troops and is seeking more military and economic gains. North Korea Education Push: Pyongyang promoted “world-class education” at its 15th National Teachers’ Congress, but rural residents remain skeptical as shortages of teachers, equipment, and aging school facilities are said to persist. Crypto Market Fallout: CoinEx began a staged shutdown after nearly nine years, ending spot trading Sept. 29 and closing withdrawals Dec. 22—an indirect reminder of how fast liquidity and access can vanish in markets North Koreans may try to tap. Regional Security Spillover: A US think-tank proposal urging Washington to narrow defense commitments in the western Pacific is drawing alarm from Indo-Pacific allies, raising questions for any future US-North Korea diplomacy. South Korea Tech Security: Seoul’s expanded espionage law took effect Sept. 13, strengthening coverage for foreign-directed spying tied to strategic technologies like semiconductors—relevant to how North Korea may try to acquire know-how. Business & Trade Signals: Korea and Turkmenistan signed 13 deals on investment, energy, logistics, and security, showing where Pyongyang-adjacent regional trade and infrastructure partnerships could indirectly shift.

Russia-North Korea Military Ties: Kim Jong Un sent Vladimir Putin a letter pledging “invariable support” for Russia’s “sacred” war, signaling deeper joint work as speculation grows about more Pyongyang troops and cooperation. North Korea-China Labor Pipeline: Daily NK reports North Korean worker dispatches to China are rising since July, but factories are shifting from large single-site placements to smaller crews spread across dozens of locations. Inter-Korean Health Prep: South Korea says it has UN clearance and budget ready to supply 166 types of medical equipment to a Pyongyang hospital if asked, despite sanctions limits. Pyongyang’s Overseas-Worker Reality: Reports say North Korean workers in China pay for injury insurance but rarely see payouts, highlighting the business terms behind labor flows. Domestic Education Costs: Daily NK says some Pyongyang-area elementary schools are collecting fees for ceremonies and classroom upkeep soon after the semester starts, adding pressure on parents. North Korea’s Tech Use for Learning: Smartphone apps for English and Chinese are spreading among students in wealthier households, widening the education gap. Security Drill Update: North Korea confirmed a Sept. 12 joint firepower drill matched a missile launch detected by South Korea, mixing drones, cruise missiles, and ballistic systems.

Inter-Korean Health Aid: South Korea says it’s “ready to go” to supply 166 types of medical equipment to Pyongyang’s Kangdong County Hospital if North Korea asks, after securing a UN sanctions exemption and budget—an assistance plan financed via the Inter-Korean Cooperation Fund. Education Costs: In Pyongsong, elementary schools are collecting fees from students within days of the fall semester, including money for flower-basket ceremonies and classroom portrait-cleaning supplies, adding fresh pressure on parents. Cyber-Linked Worker Fraud: The US warns that North Korea-linked networks may be recruiting “fake IT workers” through facilitators in countries including South Africa, Nigeria, India and Iran to land remote jobs at American firms. Russia-North Korea Military Link: Reports say Russia is preparing to send up to 50,000 North Korean troops to fight in Ukraine, raising concerns about deeper military cooperation. Trade/Business Claims Checked: Swiss inspection firm SGS denies North Korea’s claim it runs a representative office in Pyongyang, citing sanctions and export-control compliance. South Korea Espionage Crackdown: Seoul’s expanded espionage law took effect, creating a new offence for obtaining or transferring national secrets for foreign countries or equivalent organizations, with tougher penalties tied to technology theft.