Horrors of the North Korea Internet Iceberg

Summary

The video presents an “iceberg” of North Korea’s internet, moving from limited public-facing websites to alleged state cyber operations and surveillance. Its central theme is that ordinary North Koreans have little or no access to the global internet, while a small, privileged group can use it for government, military, or financial purposes.

Level 1: The Limited Public Internet

The DPRK’s external .kp domain contains only a few dozen active websites, mainly government portals, state media, and cultural or tourism pages. The video contrasts these with Kwangmyong, the closed domestic intranet, which is said to host more sites and services, including a search engine, forums, shopping, food delivery, and state-approved video content.

Foreign visitors can reportedly access the global internet through some hotel connections or a local Koryolink SIM, but at high cost and with restrictions. Koryolink, launched with Egypt’s Orascom, remains a major mobile operator despite a dispute over profits and control with the North Korean government.

Level 2: Limited Access and Controlled Networks

The video discusses a long-running claim that Valve’s activity map showed a single regular Steam user in Pyongyang. The user’s identity is unknown; suggestions that it might be a foreign embassy worker, an elite North Korean, or Kim Jong-un are presented as speculation.

Kwangmyong is described as physically isolated from the global internet and tightly controlled. The video also covers North Korean smartphones, which it says run Android-based software but include censorship and monitoring features, and Red Star OS, a Linux-based system that allegedly tracks files and restricts unauthorized software.

The video also describes cross-border balloon campaigns: South Korean activists send leaflets and media into the North, while North Korea has sent waste-filled balloons into the South. These exchanges have prompted responses, including renewed South Korean loudspeaker broadcasts.

Level 3: Banned Media, Smuggling, and Cyberattacks

The video says North Korea’s 2020 law targeting “reactionary ideology” imposes severe penalties for possessing or sharing foreign media, particularly South Korean content. In response, an underground market has reportedly grown around smuggled USB drives and memory cards containing dramas, music, films, and other material.

It recounts the 2014 Sony Pictures hack, linked to the release of The Interview, and the 2017 WannaCry ransomware outbreak, which affected computers in many countries and disrupted organizations, including UK health services. These incidents are presented as examples of North Korean cyber capabilities.

Level 4: Cyber Units and Covert Activity

Bureau 121 is described as an elite cyber unit whose recruits are selected for technical ability and given privileges, including access to the global internet. The video also profiles Rimjin-gang, a magazine that publishes reporting and images gathered by underground journalists inside North Korea and smuggled out of the country.

Another topic is “laptop farms”: schemes in which North Korean IT workers allegedly use intermediaries and remotely access computers located in the United States to obtain jobs at Western companies while disguising their location. The video cites the case of Christina Chapman, who it says helped operate a large laptop farm, and an attempted intrusion at KnowBe4.

Level 5: Revenue Streams and Infrastructure

The video says North Korean cyber groups have stolen billions of dollars in cryptocurrency and describes laundering methods involving crypto mixers, blockchain bridges, shell companies, and brokers in China and Southeast Asia.

It connects these operations to Room 39, which it describes as a secret organization tasked with acquiring foreign currency for the state. The video attributes both legal trade and illicit activities to the organization, and says cybercrime proceeds help fund government programs and elite spending.

The video also describes two international internet connections to North Korea—via China Unicom and Russia’s TransTelekom—and says the additional Russian connection reduces reliance on China and provides more capacity. Special university labs are portrayed as training sites for future cyber specialists, with selected students receiving access to the global internet.

Level 6: Major Hacking Groups and Surveillance

The Lazarus Group is presented as a prominent North Korean hacking group, associated in the video with attacks on Sony Pictures and WannaCry, the Bangladesh bank theft, the Ronin network hack, and a reported $1.5 billion theft from Bybit in 2025. Other groups are described as focusing on banking, military espionage, and geopolitical intelligence.

The video also discusses biometric surveillance, including fingerprint collection, identity databases, and efforts to use AI to recognize faces, voices, and gait. It cautions that limited funding and power interruptions may restrict how widely such systems are deployed.

Level 7: Overseas Workers and Recruitment Scams

The final section describes North Korean IT workers abroad who allegedly use false identities and remote employment to generate income for the state. It says diplomatic missions may help coordinate their movements and that salaries are transferred through complex financial channels.

The video also warns about fake technology companies and recruiters on platforms such as LinkedIn and GitHub. According to the account, applicants may be sent malicious test assignments or software that installs spyware, potentially giving attackers access to their devices or employers’ networks. The video concludes that these tactics remain a cybersecurity risk despite sanctions and platform enforcement.

Presenters and Contributors

• Presenter: Unnamed narrator for the Corium video.
• Contributor mentioned: Ishimaru Jiro, identified in the video as the founder of Rimjin-gang. He is not presented as a speaker.