Executive Summary

North Korea’s 2025 reorganization of its Reconnaissance General Bureau* into a more integrated intelligence apparatus reflects a deliberate shift from opportunistic cyber theft toward sustained, state-targeted intelligence operations. These have global reach and are enabled by Russian and Chinese cooperation.

This restructuring aligns with North Korea’s push to modernize its military—particularly drone integration—drawing on lessons from the Ukraine war, like exposure to Russian battlefield ISR practices. Further potential access to advanced satellite technologies through Moscow increases the likelihood of such a trajectory. 

Concurrently, longstanding China–DPRK cyber and infrastructure linkages appear to be deepening, providing operational basing, technical components, and routing pathways that enhance North Korea’s intelligence resilience. Collectively, these developments indicate a strategic evolution toward diversified, state-level intelligence operations supporting broader geopolitical objectives.

*Background: The North Korean intelligence community is set up around 4 main agencies, according to U.S. Department of Defense reporting. The main foreign intelligence agency is the Reconnaissance General Bureau (RGB). According to North Korean sources, the RGB was reorganized in mid-2025 and renamed “Reconnaissance Information General Bureau” (RIGB), as unveiled in a statement by Pak Jong Chon, vice-chairman of the Central Military Commission of the Workers’ Party of Korea. This reorganization included an integration of infiltration and clandestine capabilities with satellite, cyber and human intelligence analysis among other functions. According to South Korean intelligence, this will increase the RIGB’s ability to target governments, militaries, and diplomatic institutions across Asia and the West.