AGP Executive Report

NK-Russia Military Link: Ukraine’s intelligence says Pyongyang has deployed a specialized missile unit (about 90 personnel) to Russia’s Voronezh Oblast, potentially operating up to 120 ballistic missiles from six launchers, after earlier reports of North Korea delivering KN-23/KN-24 missiles and training. Missile Tests & Regional Pressure: North Korea resumed short-range ballistic missile launches toward the sea from Wonsan, with South Korea and Japan reporting no damage in Japan; the timing comes as U.S.-ROK drills approach. Cyber & Crypto Crime: A researcher says North Korean hackers’ “Contagious Interview” campaign has hit 1,640 companies across 57 countries, including major crypto firms, and that the hackers’ own infrastructure was compromised in the process. Heatwave Survival Messaging: North Korean state media promoted “sambok” coping tips, including dog-meat soup and other cooling foods, as Pyongyang reported a record 36.7°C. Diplomacy Channels: Singapore’s senior official said it can facilitate dialogue with North Korea, but any talks depend on wider geopolitical conditions beyond U.S.-NK ties. Defense Industry Context (ROK): South Korea approved a $352m purchase of up to 38 U.S. SM-6 systems to bolster ship air and ballistic defense, reflecting continued pressure from North Korea’s missile activity.

Missile Defense Procurement: South Korea’s DAPA approved a $352M Foreign Military Sales deal for up to 38 U.S. SM-6 systems, aimed at boosting Aegis destroyer air and missile defense against North Korea. Ballistic Missile Launches: Seoul reported North Korea fired a short-range ballistic missile toward the East Sea, with Japan also saying a launch did not impact its territory. Agriculture Under Heat Pressure: North Korean farm workers in South Hwanghae say they’re trapped between orders to prevent crop damage and prevent heatstroke amid near-40°C conditions, with daily reporting and grueling field labor. Cybercrime and Supply Chains: A Black Hat presentation says North Korean hackers breached 1,640 companies across 57 countries, targeting crypto wallets and developer credentials, with fake job offers used to reach victims. Regional Security Tech: Japan conducted a Tomahawk test launch from an Aegis destroyer, reinforcing its shift toward longer-range counterstrike capabilities that can reach North Korea. Defense Industry Pressure: Ukraine-linked reporting highlights how interceptor shortages and production limits are shaping air-defense outcomes, underscoring the wider arms-and-production race affecting the region.

Missile Tests & Regional Signaling: North Korea fired a short-range ballistic missile toward the Sea of Japan/East Sea from Wonsan, with South Korea and Japan tracking the launch and reporting no impact near Japan, as Pyongyang escalates rhetoric tied to Japan’s Pacific military posture. Russia-Ukraine Link (Military Supply): Multiple reports say North Korea has moved beyond troops and weapons to deploy a missile unit in western Russia, potentially fielding up to 120 short-range ballistic missiles and six launchers for strikes on Ukraine—claims Reuters could not independently verify. Air-Defense Pressure in Ukraine: Ukraine says it has received only about a third of the interceptor missiles it had at this point last year, warning that shortages are leaving cities and logistics targets exposed after recent attacks. Defense Industry & Training Spillover: South Korea is training large numbers of drone operators and expanding its drone production and training services, explicitly framed as a response to North Korea’s battlefield support to Russia. Cross-Border Infrastructure (Rail): South Korea plans to restart a stalled rail section near the DMZ that could connect to North Korea’s Wonsan, reviving a project suspended for about a decade. Cyber & Supply-Chain Risk: A researcher claims a long-running North Korean hacking campaign compromised 1,600+ organizations across 57 countries, using fake job interviews and software supply-chain tricks to gain privileged access.

North Korea–Russia Missile Cooperation: Ukraine’s military intelligence says Pyongyang has started deploying a dedicated missile unit to Russia’s Voronezh region, with about 90 North Korean personnel and plans for up to 120 KN-23/KN-24 ballistic missiles and six launchers—another step in deepening arms support as Kyiv warns air defenses are stretched thin. Air Defense Shortage Pressure: Zelenskyy and reporting from the front point to interceptor shortfalls: allies have supplied only about a third of needed air-defense missiles in 2026 versus 2025, and recent Russian barrages reportedly met near-zero interception success, raising pressure for faster production and political decisions on deliveries. Japan Watch on North Korea’s Nuclear Justification: North Korea’s Kim Yo-jong escalated rhetoric against Japan’s military evolution, framing Japan’s “preemptive strike” capability and defense changes as a threat and using it to justify “additional definite military options.” Cyber and IT Worker Theft: Multiple alerts and research highlight North Korea-linked cyber operations targeting companies and individuals—ranging from intrusions reaching root access in cloud and server environments to scams using stolen identities and deepfakes to pass hiring checks, plus supply-chain malware tied to trojanized npm packages. Inter-Korean Infrastructure Signals: South Korea moved to revive a stalled rail link toward North Korea’s Wonsan (construction starting in 2027), while Seoul’s Unification Ministry also pushed for less hostile rhetoric to support peaceful coexistence. Domestic Health Messaging: North Korea’s state media advised heat-wave nutrition guidance, including dog meat soup, as Northeast Asia faces prolonged extreme temperatures.

North Korea–Russia Missile Cooperation: Ukraine says Pyongyang has started deploying a dedicated missile unit to Russia’s Voronezh region under the 112th Missile Brigade, with about 90 personnel and plans for up to 120 ballistic missiles plus six launchers; Reuters reports Pyongyang has already shipped 40 KN-23/KN-24 missiles and trained operators, with final numbers to be set in high-level talks next month. Ukraine Air-Defense Strain: Zelensky warns allies have supplied only about a third of Ukraine’s air-defense missiles in 2026 versus 2025, and that Russia’s latest Kyiv barrage included ballistic missiles and drones that Ukraine failed to intercept, with logistics and civilian warehouses hit. Inter-Korean Infrastructure: South Korea will restart a stalled Gyeongwon Line rail section near the DMZ that could eventually connect to North Korea’s Wonsan, reviving a project suspended since 2016; the plan is framed as boosting access to tourism and border-region activity despite Pyongyang’s 2024 demolition of cross-border road and rail links. Diplomatic Tone Shift: Seoul’s Unification Ministry proposes dropping the “main enemy” label for North Korea and using the DPRK’s official name to support peaceful coexistence and restart phased dialogue. Pyongyang’s Urban Build-Out: Satellite imagery analysis finds Pyongyang’s nighttime lights have expanded mainly in the downtown area over six years, aligning with the regime’s large apartment construction push.

Missile Defense Supply Crunch: US commanders say the Pentagon has burned through nearly 80% of THAAD interceptors and about half of Patriot interceptors since the Iran war began, raising alarms that stocks are “dangerously low” and could limit Gulf allies’ ability to intercept retaliatory missile and drone attacks. Japan Defense Industry Push: Japan’s 2026 defense white paper frames AI- and drone-driven warfare as the new norm, calls for faster military transformation, and stresses strengthening the domestic defense production base while deepening ties with tech firms and startups. NK-Russia Security Link: Tokyo’s assessment highlights growing China-Russia-North Korea coordination, citing North Korea’s missile modernization ties with Russia as a serious regional risk. NK Cyber and Identity Fraud Threat: US-linked reporting notes North Korean hackers are tied to deepfake and stolen-identity hiring scams, with companies moving toward stronger identity verification and deepfake detection to block impersonation. NK Economy Signal: South Korea-linked coverage says North Korea’s economy grew for a third straight year in 2025, supported by closer China-Russia ties and arms trade.

North Korea–US Cyber Row: Pyongyang rejected a US-led “joint warning” alleging DPRK remote IT workers use fake identities and AI to fund weapons, calling it a political smear and accusing Washington of militarizing cyberspace. Missile Production Signals: Reports say North Korea is expanding ballistic missile production capacity to raise output rates across short-, medium-, and long-range systems, with no official DPRK comment. Exercise Fallout: North Korea condemned RIMPAC as a “war rehearsal,” warning it will respond with a “new level” of deterrence as the US, Japan, and South Korea expand drills and command cooperation. Defense Industry Context in the Region: Japan’s 2026 defense white paper pushes faster drone/AI development and stronger defense production, while explicitly flagging growing military cooperation involving China, Russia, and North Korea. Maritime/Regional Security Backdrop: Separate coverage notes a Kuwait base strike and incidents near the Strait of Hormuz, underscoring how regional conflict risk can spill into shipping and logistics.

North Korea-linked cyber supply-chain risk: Amazon Threat Intelligence tied recent compromises of popular NPM packages (axios, debug, chalk, typo-crypto) to a North Korean hacking group (SAPPHIRE SLEET/SAPPHIRE SLEET-linked names), describing attacks that hijack trusted maintainers to push malicious updates at scale. North Korea’s “homegrown” security software: Reporting says Pyongyang’s national antivirus quietly pivoted to ClamAV’s open-source engine, rebuilt and shipped under multiple domestic product names—suggesting reliance on foreign code while obscuring origin. Sanctions pressure on missile production: Ukraine’s Zelenskyy urged tighter, synchronized sanctions aimed at Russia’s ballistic-missile and drone supply chains, warning loopholes still let key firms bypass restrictions—an issue that also affects North Korea-linked military trade. North Korea-Russia logistics buildout: A report highlights Russia and North Korea nearing completion of a new road bridge near the Korean-Russian Friendship Railway Bridge, raising concerns it could improve military logistics. North Korea economy signal: South Korea-linked reporting says North Korea’s growth topped 3% for a third straight year in 2025, fueled by closer Russia ties and arms trade.

Sanctions Pressure on Missile Production: Ukrainian President Zelenskyy urged tighter, synchronized sanctions on Russian ballistic-missile makers, saying loopholes still let key firms evade US/UK/Japan/Swiss restrictions—and warning the same problem extends to North Korea-linked supply chains. North Korea Cyber Defense Built on Foreign Code: North Korea’s national antivirus reportedly pivoted to ClamAV, recompiling and packaging it under multiple domestic product names to mask origins while inheriting foreign detection and update mechanics. South Korea Defense Overhaul with North Korea Focus: Seoul launched new counterintelligence and security bodies to replace the disbanded Defense Counterintelligence Command, with explicit mandates to block North Korea and foreign espionage, protect defense-industry secrets, and secure AI and satellite systems. Russia-North Korea Logistics Bridge Watch: Reporting highlights Russia’s fast-progressing road bridge near the Korean-Russian Friendship Railway Bridge, raising concerns it could improve military logistics tied to North Korea. Maritime Strategy Lens: Analysis argues North Korea’s naval buildup is about layered coercion—missile ships, submarines, mines, and unmanned systems—to complicate allied planning rather than chase blue-water dominance.

Defense & Security Reform: South Korea’s defense ministry launched a new counterintelligence unit to target espionage and terror threats from North Korea, with added focus on protecting defense-industry secrets and advanced tech like AI and satellite systems. Cyber & IT Workforce Threats: Eleven allied governments warned that North Korean IT operatives are using real-time AI deepfakes to bypass live interview checks, impersonating candidates during hiring and funneling funds toward nuclear and missile programs. North Korea-Linked Crypto Theft: A Blockaid report says North Korea-linked attackers drove over half of stolen crypto funds in H1 2026, with $1.1B lost across 212 incidents and major drains tied to Lazarus-linked activity. North Korea in the Russia War Machine: Ukraine reported that Russian forces used North Korean ballistic missiles in strikes, including a recent attack that killed a family, underscoring Pyongyang’s role in supplying battlefield munitions. Trade & Growth Signals: South Korea-linked reporting says North Korea’s economy grew for a third straight year in 2025, supported by closer Russia ties boosting trade and arms production.

North Korea Cyber & IT: Eleven allied governments warned that North Korean IT operatives are using real-time AI deepfakes to impersonate candidates during live job interviews, bypassing common identity checks and funneling funds to Pyongyang’s nuclear and missile programs. Crypto Theft Spillover: A new Blockaid tally says DPRK-linked actors drove more than half of crypto losses in H1 2026, with $1.1B stolen across 212 incidents; major drains included KelpDAO and Drift, tied to North Korean-linked clusters. NATO Fuel Network Claim: North Korea accused NATO of accelerating war preparations, arguing its planned European fuel pipeline and storage buildout signals a broader push toward the Asia-Pacific and heightened pressure near the Korean peninsula. Korean Peninsula Diplomacy: Indonesia’s Prabowo said South Korea’s Lee asked him to visit North Korea to open dialogue, and he is willing to do so, with Seoul saying friendly states like Indonesia can help foster coexistence. Industry/Trade Context: South Korea’s Lee returned from an 11-day AI and critical-minerals supply-chain trip, with attention now on whether diplomatic gains translate into domestic industrial policy.

DPRK-Russia Trade & Military Output: South Korea says North Korea’s economy grew 3.5% in 2025 for a third straight year, driven by expanded cooperation with Russia, more weapons production for Moscow, and higher food output tied to more Russian tourists. Missile Supply Chain in Ukraine: Kyiv says a North Korean missile fired by Russia killed a family in central Ukraine, underscoring how Pyongyang’s hardware is feeding the war and how quickly the “missile lab” model is returning. NATO Fuel Network Pushback: Pyongyang accuses NATO of accelerating war preparations via an expanded European military fuel network, framing it as preparation for operations beyond Europe and near the Korean peninsula. Diplomacy Channeling: Indonesia’s Prabowo says South Korea asked him to visit North Korea to open dialogue, and he’s willing—while Seoul says friendly states like Indonesia can help foster peaceful coexistence. Cyber & Crypto Spillover: Amazon and other security reporting link North Korean activity to open-source software supply-chain attacks, while separate reporting highlights crypto theft losses topping $1B in H1 2026, with investigators pointing to North Korea-linked operations.

North Korea-Russia Military Ties: South Korea says North Korea’s economy grew 3.5% in 2025 for a third straight year, driven by expanded cooperation with Russia and more trade with China, with weapons production for Russia rising and more Russian tourists boosting food output. Missile Supply Chain in Ukraine: Ukraine says Russia used North Korean KN-23 ballistic missiles in strikes near Kryvyi Rih, including a second missile impact found in a field; the attacks underscore Pyongyang’s role as a “missile lab” supplier to Moscow. IT Workers Sanctions: 11 countries including the U.S. and South Korea issued a joint alert on North Korean IT workers using false identities and online contracting to earn money for WMD and missile programs, urging stronger identity checks and countermeasures. Diplomacy via Indonesia: Indonesia’s Prabowo said South Korea’s Lee asked him to visit North Korea to open dialogue, and he would go; Seoul says countries friendly to both Koreas can help foster coexistence. Cybercrime Spillover: Reports tie North Korea-linked activity to major crypto and open-source supply-chain attacks, including npm-related compromises and DeFi thefts that auditors missed.

North Korea Economy: South Korea’s Bank of Korea estimates put North Korea’s 2025 real GDP growth at 3.5%, the third straight year above 3%, driven by expanded economic cooperation with Russia, more trade with China, and national projects—while weapons production for Russia and higher food output tied to Russian tourism lift manufacturing and services. Defense-Industrial Links: Ukraine says Russia resumed using North Korean KN-23 ballistic missiles, killing a family in Radushne; a second KN-23 crater was found 3.5 km away, and officials argue the missiles mirror Russia’s Iskander system and share components, including Western-made parts—highlighting how Pyongyang’s missile supply chain feeds battlefield output. Cyber/IT Labor for WMD Funding: A joint alert from the US and 10 allies warns that North Korean IT workers use stolen identities and proxy networks to win online contracts and remit earnings to fund nuclear and missile programs, also enabling insider threats, data theft, and crypto theft. Supply-Chain Cybercrime: Amazon links multiple npm package compromises (including axios, debug, and chalk) to a DPRK-linked actor tracked under names like Sapphire Sleet/BlueNoroff, showing how trojanized updates and post-install hooks can spread access across thousands of downstream systems. Industry Watch: With Russia-Ukraine strikes disrupting regional logistics, shipping from Ukraine’s Odesa ports reportedly hit a “complete halt,” a reminder that war-driven bottlenecks can quickly ripple into production and trade.

North Korea Economy: South Korea’s Bank of Korea estimates Pyongyang’s real GDP grew 3.5% in 2025 for a third straight year above 3%, helped by expanded trade and economic cooperation with Russia and China, plus state-led projects; manufacturing rose 6.6% (light industry up 3.8% after a prior slump), construction grew 6.3%, while mining slowed to 1.6%. Defense-Linked Industry: The same estimates tie growth to higher weapons exports to Russia and to foreign-currency inflows from dispatched labor and troops supporting Russia’s war. Exports & Supply Chains: North Korea’s exports are estimated up 30% to $470 million in 2025, with “prepared feathers and wigs” cited among drivers, alongside unspecified toys and sporting goods. Diplomacy for Dialogue: Indonesia’s Prabowo said South Korea asked him to visit North Korea to open a dialogue channel, and he is willing to go if formally requested—another sign of regional efforts to manage Pyongyang-related risks. War-Linked Missile Use: Ukraine’s Zelenskyy said Russia used a North Korean ballistic missile in a strike on Radushne, marking a suspected return after a long gap, underscoring how Pyongyang’s military production is feeding external demand.

North Korea–Russia Missile Link: Ukraine says Russia used a North Korean ballistic missile in the Radushne strike that killed a family of 10, with officials pointing to a first suspected use in nearly a year and renewed missile-stockpile concerns. Defense Supply Pressure: The same attacks come as Zelensky warns of air-defense interceptor shortages, while Poland signals it may send more Patriot missiles if needed. Naval Modernization: North Korea commissioned the new destroyer Choe Hyon for the West Sea Fleet, framing it as part of a push to strengthen warship-building and deterrence. Cyber/Software Supply Chain: Multiple reports tie DPRK-linked hackers to open-source software compromises, including npm library attacks (axios, debug, chalk, typo-crypto) and macOS malvertising that uses fake update prompts to deliver crypto-stealing malware. Crypto Theft Tactics: Seoul police arrested suspects tied to a fake staking site that drained XRP from investors, highlighting how fast fraud and wallet targeting are moving. Industry & Trade: South Korea and Chile agreed to restart their FTA committee after a decade, with added focus on critical minerals and shipbuilding—relevant to regional supply-chain planning. Construction Safety: Daily NK reports North Korea evacuated residents after a newly built apartment showed collapse risk, then detained a construction section chief over rushed methods.