North Korea’s ruling elite are technologically savvy, use a full range of older and cutting-edge computers, phones and devices and use the Internet as a tool for sanctions circumvention and recently shifted to embrace Chinese social networking services over Western ones, according to the U.S. technology and Internet monitoring firm Recorded Future.

It reported that “shifting patterns in North Korean ruling elite’s Internet usage reveal just how adaptable and innovative Pyongyang’s most top leaders are.”

It said the Kim regime had developed a “unique model for using and exploiting the Internet, and North Korean leaders are quick to embrace new services or technologies when useful and cast them aside when not.”

Its conclusions are:

• The Internet is probably becoming a more regular professional tool for North Korea’s most senior leadership. As the leadership becomes more Internet savvy and professionalize their use of the Internet, it will exacerbate existing challenges in sanctions enforcement and computer network defense.
• North Korean senior leaders exhibit significantly greater operational security today than in early 2017. This awareness, combined with the increasing global use of large domain hosting and Internet infrastructure providers, has over time negatively impacted visibility into the daily Internet activities of North Korea’s ruling elite.
• The Recorded Future identified several nations that are likely to be hosting North Korean workers who are employed in the service or information economy as opposed to purely manual laborers. Those countries include China, India, Nepal, Bangladesh, Mozambique, Kenya, Thailand and Indonesia.
• The Recorded Future also discovered an asset-backed cryptocurrency scam called Marine Chain operated by a network of North Korean enablers in Singapore, and at least one other scam coin, called Interstellar, Stellar, HOLD or HUZU, also possibly tied to North Korea
• The migration away from Western social media and services has persisted. It observed low-volume but the regular and consistent use of LinkedIn by North Korean leaders from April in 2018.

It reported that there are a select few among North Korea’s most senior leadership who are allowed direct access to the global Internet.

“While there are no reliable numbers of North Korean Internet users, the profile of a North Korean Internet user is clear: they are a trusted member or family member of the ruling class,” it added.
It pointed out three primary ways North Korean elites access the global Internet. The first method is via their allocated .kp range, 175.45.176.0/22, which also hosts the nation’s only Internet-accessible websites. These include nine top-level domains such as co.kp, gov.kp, and edu.kp, and approximately 25 subdomains for various North Korean state-run media, travel, and education-related sites.

The second method is via a range assigned by China Netcom, 210.52.109.0/24. The “KPTC” is the abbreviation for Korea Posts and Telecommunications Co.

The third method is through an assigned range, 77.94.35.0/24, provided by a Russian satellite company, which currently resolves to SatGate in Lebanon, the report noted.