Some file names gave clues to the serial and episode numbers. There were also files and projects that the researchers couldn’t identify — including a “bunch of files” containing videos of horses and a Russian book about horses, Williams says.
Sanctions imposed on the North Korean regime over its ongoing human rights abuses and nuclear war programs prohibit U.S. companies from working with DPRK companies or individuals. But researchers say it is highly unlikely that the companies involved had any knowledge of North Korean animators working on the shows, and there is no evidence that the companies violated sanctions or other laws. “It is likely that the contract agreement came several steps after the major producers,” the report said.
Spokespeople for Amazon and Max declined to comment for this story. YouNeek Studios did not respond to a request for comment.
“We do not work with North Korean or Chinese companies Invincibleor affiliated companies and have no knowledge of any North Korean or Chinese companies working on it Invinciblesays a spokesperson for Skybound Entertainment. “We take all claims very seriously and have launched an investigation into this matter.” In one Post on XThe company called the findings “unconfirmed” and said it was working with authorities on the investigation.
Williams believes it is possible that a front company in China is being used to conceal the activities and involvement of the North Koreans. Researchers were able to analyze connections to the exposed server and discovered access from Spain and three Chinese cities, although the location of most was masked by a VPN. “All three cities are known to have many North Korean-run businesses and are major centers for North Korean IT workers living abroad,” the report said.
While Williams says researchers did not find any identifiable names of North Korean organizations in the files, there is an established animation company in the country called April 26 Animation Studio, also known as SEK Studio. Originally founded in the 1950s, the studio has worked on hundreds of international television shows and films.
However, in recent years, the U.S. Treasury Department has imposed sanctions on SEK Studios, individuals associated with it, and various “sham companies” that it says “work for foreign clients.” Many of them have connections to China, the sanctions say. “SEK Studio used a number of front companies to evade sanctions against the government of the DPRK and deceive international financial institutions,” it said in a statement issued as part of the sanctions in 2021.
The main goal of this effort is to raise money for the North Korean regime, says Michael Barnhart, North Korea researcher at Mandiant. The country’s hackers and fraudsters have stolen and extorted billions of dollars in recent years to fund its military ambitions, including through huge cryptocurrency heists. In early 2022, the FBI issued a 16-page alert warning companies that remote North Korean freelance IT workers were infiltrating companies to make money that they could funnel back home.
“The volume is much higher than we expected,” Barnhart said of North Korea’s IT workers. They constantly change their tactics to avoid getting caught, he says. “We had one not long ago where the person’s mouth was just out of frame during the interview. You could tell someone was speaking on their behalf in the background.” Technically, Barnhart says companies should check their remote employees’ devices and make sure no remote software is connecting to a company laptop or network. Companies should also put extra effort into the hiring phase by training human resources staff to identify potential IT employees.
But he says there is increasingly greater overlap between North Korean IT workers and people who are members of known hacking groups or classified as advanced persistent threats (APTs). “The more we focus on IT workers, the more we see APT operators and efforts merging with them,” he says. “This could be the fastest learning, most nimble nation state I have ever seen.”