|
Quotes of the Day:
“in 1917, Lenin impressed on the newly appointed Commissar for Education that libraries would be a key weapon in the fight for hearts and minds: Try to pay attention to libraries in the first instance. We must borrow from progressive bourgeois countries all those methods they have developed for making library books widely available. We must make books accessible to the masses as soon as possible. We must try to make our books available all over Russia, in as large a quantity as possible.”
– The Book at War: How Reading Shaped Conflict and Conflict Shaped Reading by Andrew Pettegree
“I think the American Dream should be to have a good life, and to live well, and to be a good citizen. I think that should apply to all of us.”
– Rosa Parks
“The most revolutionary act is a clear view of the world as it really is.”
– Rosa Luxemburg
1. North Korea’s Reconnaissance General Bureau (RGB)
2. North Korea's clandestine Bureau 39 gets new chief
3. Korea: Those who beg for peace and those who brandish the bomb
4. Kim Yo Jong promoted as North Korea ends Workers' Party Congress
5. South Korea, Japan enter rivalry as U.S. rebuilds maritime industry
6. North Korean Lazarus Group Now Working With Medusa Ransomware
7. ROK envoy urges North Korea to comply with nuclear treaty, return to talks
8. Column: Role of U.S. Forces Korea already shifting
9. Joint Interagency Task Force Announces Counter-UAS Marketplace
10. USFK chief expresses 'regret' to Seoul defense minister over air standoff incident with China
11. USFK Denies Apology Over West Sea Exercise Standoff
12. North Korea hands out Russian flour for Kim Jong Il’s birthday
1. North Korea’s Reconnaissance General Bureau (RGB)
Comment: Another important contribution from Robert Collins. Anyone who wants to understand north Korea must understand the RGB.
Download the 104 page document here: https://www.hrnk.org/wp-content/uploads/2026/02/RGB_Final.pdf
https://www.hrnk.org/documentations/the-reconnaissance-general-bureau-the-kim-regimes-precious-treasured-sword/
North Korea’s Reconnaissance General Bureau (RGB) is the Kim regime’s leading foreign intelligence agency. However, it is far more than an intelligence agency in the traditional sense. Comparisons with the U.S. Central Intelligence Agency (CIA) or South Korea’s National Intelligence Service (NIS) are misleading and incomplete. The RGB is not only a military reconnaissance unit, but also a combat unit, a cyber warfare group, an espionage bureau, a criminal enterprise, a terrorist organization, and a revolutionary entity all organized under a single control and command network that directly reports to North Korea’s Supreme Leader, Kim Jong-un. The RGB’s component predecessors have been, and continue to be, a direct threat to the independence, lives, and human rights of the South Korean people. Assassination, massacre, abduction, destruction of personal property, sabotage, subterfuge, and cyber theft are just some of the methods the RGB and its predecessors have used to deny South Korean citizens their rights and personal safety. North Korea’s intent has been, and continues to be, enabling the Kim family regime to unify the Korean Peninsula under its rule and subjugating South Korea and its citizens to the same crimes against humanity experienced by North Korean citizens. The RGB is integral to this twisted dream.
Download Documents
2. North Korea's clandestine Bureau 39 gets new chief
Comment: Form a former senior official in Office 39.
World News Feb. 24, 2026 / 9:43 AM
North Korea's clandestine Bureau 39 gets new chief
Kim Jong Un reshuffles key financial office.
By Ri Jong-ho
https://www.upi.com/Top_News/World-News/2026/02/24/Bureau-39-North-Korea-new-chief/7561771943037/
North Korean leader Kim Jong Un (C) and officials applaud during the fourth day of the Ninth Congress of the Workers' Party of Korea in Pyongyang, North Korea, on Sunday. Kim was re-elected general secretary of the ruling Workers' Party, according to the North Korean Central News Agency. Photo by North Korean Central News Agency/EPA
Feb. 24 (UPI) -- The head of North Korea's Bureau 39, the clandestine office widely believed to manage leader Kim Jong Un's personal slush fund and off-the-books revenue streams, has been replaced after the regime's 9th Workers' Party Congress, according to an analysis of newly released party rosters.
The name of Sin Ryong-man, who was born in 1959 and who has served as Bureau 39 director for the past nine years, was conspicuously absent from the list of Central Committee members and candidate members -- a strong indicator that he has been removed from his post.
Sin was promoted to director in October 2017, succeeding his predecessor, Jon Il-chun, to become the fourth chief in the bureau's history. During his tenure, he served as Kim Jong Un's de facto financial steward, overseeing the opaque funding mechanisms that underpin the regime's political and personal finances.
Bureaucratic insider takes the helm
Han Sang-man, who was born in the mid-1960s, is expected to assume the role as the bureau's fifth director. A career insider who worked his way up through the ranks -- serving successively as staff officer, section chief and deputy director within Bureau 39 -- his name appeared for the first time on the list of Central Committee candidate members, a move widely interpreted as a precursor to formal appointment.
The appointment is consistent with Kim Jong Un's well-documented preference for promoting technically experienced, system-trained insiders over political loyalists with higher profiles.
Bureau 39 was established in 1974 and has been led by a succession of five directors: Choe Bok-man, Kim Dong-un, Jon Il-chun, Sin Ryong-man, and now, in all likelihood, Han Sang-man.
Choe Ryong-hae also dropped from rosters
The personnel shakeup extends beyond Bureau 39. Choe Ryong-hae, long regarded as North Korea's de facto second-in-command, also was absent from the updated Central Committee membership list.
The move stands in sharp contrast to the tenure of his predecessor, Kim Yong-nam, the former president of the Presidium of the Supreme People's Assembly, who held his position until age 90. The circumstances behind Choe's removal are not yet fully understood, and the implications of this departure warrant close attention.
Ri Jong-ho is a former senior North Korean economic official who served under all three leaders of the Kim family regime. His most recent role was based in Dalian, China, where he headed the Korea Daehung Trading Corp., overseen by the clandestine Office 39 under the direct control of the ruling Kim family. Before his assignment in Dalian, Jong-ho held pivotal positions, including president of the Daehung Shipping Co. and executive director of the Daehung General Bureau of the North Korean Workers' Party, a role equivalent to vice-minister rank in the North Korean party-state. Subsequently, he was appointed chairman of the Korea Kumgang Economic Development Group under the North Korean Defense Committee by Kim Jong Il. Jong-ho is a recipient of the Hero of Labor Award, the highest civilian honor in North Korea. Following a series of brutal purges by Kim Jong Un, he defected with his family to South Korea in late 2014. Currently, Jong-ho resides in the greater Washington D.C., area.
3. Korea: Those who beg for peace and those who brandish the bomb
Comment: Also from Ri Jong-ho from north Korea.
Voices Feb. 24, 2026 / 10:40 AM
Korea: Those who beg for peace and those who brandish the bomb
By Ri Jong-ho
https://www.upi.com/Voices/2026/02/24/perspective-north-korea-nuclear-hammer/5971771944629/
Multiple 600mm-caliber multiple rocket launchers parade during a ceremony presenting the launchers to the Ninth Congress of the Workers' Party of Korea by munitions industry employees in Pyongyang, North Korea. on Wednesday. Photo by Korean Central News Agency/EPA
Feb. 24 (UPI) -- South Korea's Minister of Unification Jung Dong-young announced Wednesday the preemptive restoration of the Inter-Korean Comprehensive Military Agreement, including the re-establishment of no-fly zones near the Military Demarcation Line.
The South Korean government declared it would unilaterally open the door, invoking the language of "trust-building."
Yet, the very next day, North Korean leader Kim Jong Un attended a ceremony that presented 50 units of the 600mm super-large multiple rocket launcher (KN-25), personally driving one of the launch vehicles while threatening to reduce the entire Korean Peninsula to nuclear ashes.
South Korea extended a hand, holding an agreement; North Korea raised a nuclear hammer in response. This single scene encapsulates the tragic reality on the Korean Peninsula today.
Related
Kim Jong Un described the KN-25 as "an ultra-powerful offensive weapon that perfectly combines the precision and destructive power of tactical ballistic missiles with the rapid salvo-fire capability of multiple rocket launchers."
He further said the system is "optimized for special attack missions and the execution of strategic objectives" is tantamount to an open declaration of its nuclear delivery capability.
The system he unveiled features a five-round launch pod mounted on a four-axle wheeled vehicle. With a range of about 249 miles, the entire Korean Peninsula falls within its strike envelope. A simultaneous volley from all 50 launchers could unleash up to 250 warheads in a matter of seconds.
Pyongyang further boasted of anti-jamming capabilities, composite guidance systems and integration of artificial intelligence -- claiming precision and battlefield survivability. North Korea has now elevated even its rocket artillery into the category of strategic weapons.
The nature of the Kim regime -- unification through nuclear force alone
I vividly recall a Korean Workers' Party lecture held in Pyongyang in the immediate aftermath of the June 15, 2000, Inter-Korean Joint Declaration. At the time, I was serving as president of the Daehung Trading Corp. in North Korea. Just three days after President Kim Dae-jung had departed Pyongyang, the lecturer conveyed the instructions of Kim Jong Il in the following terms:
"Harbor not even the slightest illusion about the South Korean puppet president Kim Dae-jung. He came to us waving a white flag, driven by fear of the might of our Songun politics - nothing more."
What followed, delivered to senior cadres, was even more unambiguous:
"In the end, unification can only be achieved through nuclear force. We must not relax our vigilance for a single moment."
This is the immutable nature of North Korea's dynastic regime. For it, dialogue is not an end, but a means -- a tactical deception designed to secure the funds needed to prop up a collapsing system and to buy time to develop ever more powerful weapons.
Since the June 15 Declaration, four inter-Korean summits and dozens of working-level talks have taken place. Over that same period, North Korea's nuclear capabilities have advanced exponentially. Decades of history have demonstrated this truth repeatedly, yet we continue to indulge the same illusions.
No-fly zones -- choosing to blind ourselves
The centerpiece of Jung's announced "preemptive restoration" of the Inter-Korean Military Agreement is the re-establishment of no-fly zones along the Military Demarcation Line, categorized by aircraft type.
Under the 2018 agreement, unmanned aerial vehicles are prohibited within 9.3 miles of the line in the eastern sector and 6.2 miles in the western sector; fixed-wing reconnaissance and combat aircraft within 24.8 miles in the east and 12.4 miles in the west; helicopters within 6.2 miles; and balloons within 15.5 miles.
The government's rationale -- preventing accidental clashes in the border region, foreclosing North Korean pretexts for provocation and reopening channels of dialogue -- is not without a certain internal logic.
But it collapses entirely against the cold reality of the inter-Korean confrontation. Since the 2018 agreement, North Korea has not ceased its provocations for a single day, which include GPS jamming, unmanned aerial vehicle incursions and the launch of hundreds of balloons carrying waste across the border. Pyongyang did not honor the agreement. Seoul did.
To voluntarily restrict the operations of South Korean UAVs, reconnaissance aircraft and combat aircraft near the line is to gouge out the very eyes needed to detect an enemy assault. It is an act of military self-destruction that forfeits the capacity for timely response in a contingency.
Such restrictions will inevitably erode the vigilance of frontline troops and degrade defensive readiness to the exclusive benefit of the adversary. At a moment when 50 enemy rocket launchers can saturate a target with hundreds of warheads in seconds, voluntarily dismantling our surveillance and early-warning capabilities is not a peace policy -- it is an abdication of national defense.
Facing a nuclear-armed hostile regime, it can only be characterized as a betrayal of the will to defend the nation.
Kim Jong Un a more dangerous calculation
Kim Jong Un is more brazen and more audacious than his father, Kim Jong-il, ever was. He has completed the operational deployment of super-large multiple rocket launchers with a 249-mile range, medium- and short-range ballistic missiles, drones and tactical nuclear delivery systems -- all aimed directly at Seoul's urban core, critical infrastructure and military installations.
He no longer conceals his intentions behind ambiguous language. He declares openly that nuclear weapons are not a bargaining chip, but rather an instrument of war.
Against this backdrop, the expectation that a worn piece of paper bearing the words "Inter-Korean Military Agreement" can guarantee security is divorced from reality. Weakness does not earn respect. When the balance of power breaks down, an adversary does not choose dialogue -- it chooses pressure.
Peace without strength does not endure
Genuine peace may begin with goodwill, but it is sustained only by strength. An adversary recalculates only when faced with overwhelming deterrence and the credible will to employ military force.
What the Republic of Korea must do now is not reach for another agreement. It must rebuild its deterrent posture. The full restoration of ROK-U.S. combined exercises and the strengthening of independent surveillance and reconnaissance capabilities are not optional measures, but rather strategic imperatives.
Only when Kim Jong Un's calculus of aggression confronts an unacceptable cost will he consider returning to the negotiating table. Goodwill without power, regardless of how pure the intent, ultimately places the nation in peril.
If we want peace, we must first build the strength to defend it. That is the lesson history has taught us -- and the one we have yet to learn.
Ri Jong-ho is a former senior North Korean economic official who served under all three leaders of the Kim family regime. His most recent role was based in Dalian, China, where he headed the Korea Daehung Trading Corp., overseen by the clandestine Office 39 under the direct control of the ruling Kim family. Before his assignment in Dalian, Jong-ho held pivotal positions, including president of the Daehung Shipping Co. and executive director of the Daehung General Bureau of the North Korean Workers' Party, a role equivalent to vice-minister rank in the North Korean party-state. Subsequently, he was appointed chairman of the Korea Kumgang Economic Development Group under the North Korean Defense Committee by Kim Jong Il. Jong-ho is a recipient of the 'Hero of Labor' Award, the highest civilian honor in North Korea. Following a series of brutal purges by Kim Jong Un, he defected with his family to South Korea in late 2014. Currently, Jong-ho resides in the greater Washington D.C., area.
4. Kim Yo Jong promoted as North Korea ends Workers' Party Congress
Comment: What does this portent for succession and competition with Kim Ju-ae? It is all in the family.
World News Feb. 24, 2026 / 3:10 AM
Kim Yo Jong promoted as North Korea ends Workers' Party Congress
By Thomas Maresca
https://www.upi.com/Top_News/World-News/2026/02/24/Kim-Yo-Jong-promotion-Workers-Party-Ninth-Congress/6021771919757/
Kim Yo Jong, sister of North Korean leader Kim Jong Un, was promoted to department director at the tuling Workers’ Party’s Ninth Congress, state media reported Tuesday. In this 2019 photo, Kim is seen at a wreath-laying ceremony in Hanoi, Vietnam. File Pool Photo by Jorge Silva/EPA-EFE
SEOUL, Feb. 24 (UPI) -- North Korean leader Kim Jong Un concluded the ruling Workers' Party's Ninth Congress with a pledge to strengthen the country's economy, as his sister Kim Yo Jong was promoted to a higher party role in a leadership reshuffle announced at the gathering, state media reported Tuesday.
The state-run Korean Central News Agency said that Kim Yo Jong was named an alternate member of the Political Bureau of the Workers' Party Central Committee and was listed among newly appointed department directors, elevating her formal status within the party hierarchy.
She previously served as a vice department director at the committee.
The promotion highlights the continued influence of Kim's younger sister, who has played a prominent role in diplomacy and propaganda in recent years and is widely viewed by analysts as one of the regime's most powerful figures.
Related
KCNA did not specify her new portfolio, but South Korea's Yonhap News Agency reported that she could be tapped to head the party's propaganda department, where she has been serving. A South Korean Unification Ministry official told local media that Seoul is "watching closely" to see whether Kim Yo Jong takes on a role overseeing inter-Korean or external affairs.
In a lengthy concluding speech released by KCNA, Kim Jong Un framed the congress as a turning point aimed at advancing the country into a new stage of socialist development and implementing a new five-year economic plan.
He said the upcoming period would focus on "stabilizing and consolidating our economy and bringing about its gradual qualitative development."
Kim also stressed ideological discipline and the need to eliminate outdated practices, calling for renewed efforts under the party's long-standing "three revolutions" -- ideological, technological and cultural.
The North Korean leader pledged to improve living standards and fulfill promises made to the public, saying the newly elected central committee would work to deliver "more substantial benefits" to the people.
Kim's remarks contained no direct references to South Korea or the United States, subjects analysts had been watching closely amid expectations the congress might signal a shift in foreign or security policy.
The KCNA coverage also made no mention of Kim's daughter, Ju Ae, whose increasingly frequent public appearances have fueled outside speculation about her role as a future successor.
The party congress, held roughly once every five years, is one of North Korea's most important political events, setting policy direction and reshuffling top leadership. On Monday, delegates re-elected Kim Jong Un as the Workers' Party's secretary-general, extending his control over the country's ruling party as he enters a new five-year political cycle.
5. South Korea, Japan enter rivalry as U.S. rebuilds maritime industry
Summary:
Nohsok Choi argues the U.S. “American Maritime Action Plan,” unveiled Feb. 13, seeks to rebuild America’s maritime industrial base for long-term naval superiority amid competition with China, while reaffirming cooperation with South Korea and Japan. The plan envisions up to 448 vessels by 2037 and a phased “bridge strategy” that allows foreign shipbuilders to build initial portions abroad while investing in U.S. production through partnerships or acquisitions. This opens a structural rivalry between Seoul and Tokyo for industrial positioning in the Asia-Indo-Pacific maritime order. Choi urges South Korea to move with discipline: advance shipbuilding legislation, stabilize labor relations, and build early credibility with Washington.
Comment: This is not just ship contracts. It is "alliance geometry," because whoever proves reliable first will shape where the U.S. Navy repairs, builds, and trusts in the next decade. South Korea’s risk is not lack of capacity. It is friction at home, because labor instability and legislative delay can turn strength into doubt when Washington is choosing long-term partners.
If rivalry with Japan is baked into the new framework, how does South Korea compete hard for positioning while still protecting trilateral cohesion when China is the stated pacing challenge?
Voices Feb. 23, 2026 / 11:23 AM
South Korea, Japan enter rivalry as U.S. rebuilds maritime industry
By Nohsok Choi
https://www.upi.com/Voices/2026/02/23/South-Korea-Japan-strategic-rivalry-American-Maritime-Action-Plan/7741771863227/
South Korean President Lee Jae Myung (R) shakes hands with Japanese Prime Minister Sanae Takaichi ahead of their talks in Gyeongju, North Gyeongsang Province, southeastern South Korea, in October 2025. File Photo by Yonhap/EPA
Feb. 23 (UPI) -- On Feb. 13, the United States unveiled its "American Maritime Action Plan," a sweeping initiative aimed at rebuilding America's maritime industrial base to sustain long-term naval superiority amid intensifying strategic competition with China. By explicitly reaffirming continued cooperation with historic partners -- including South Korea and Japan -- Washington has opened a new phase of allied industrial coordination. At the same time, the initiative has set the stage for a consequential strategic rivalry between Seoul and Tokyo.
The plan envisions ordering up to 448 vessels by 2037 and outlines a phased "bridge strategy" allowing foreign shipbuilders with existing contracts to construct initial portions abroad while investing in U.S.-based production capacity through acquisitions or partnerships. The objective is not merely fleet expansion, but the reconstruction of domestic shipbuilding capacity capable of supporting sustained maritime resilience in the decades ahead.
This framework effectively inaugurates a new era of strategic industrial competition. Countries seeking to deepen cooperation with Washington now face a narrowing window to secure long-term positioning within a reshaping U.S.-led maritime architecture. Among them, South Korea and Japan stand at the forefront. By construction volume, South Korea ranks among the world's leading shipbuilders, while Japan retains deep technical capabilities and decades of operational familiarity with U.S. naval systems.
For South Korea, the stakes are considerable. During tariff negotiations with Washington last year, Seoul even introduced the symbolic term "MASG" -- Make American Shipbuilding Great Again -- to represent bilateral shipbuilding cooperation. American industrial revitalization has been viewed in Seoul not merely as an external policy shift, but as a potential catalyst for strengthening South Korea's own global standing in high-value shipbuilding. For a country that has only recently consolidated its status among advanced economies, the sector represents more than export performance; it reflects long-term industrial influence and technological leadership.
Related
Japan's participation in the U.S. framework, however, inevitably intensifies competitive pressure. At Yokosuka Naval Base in Kanagawa Prefecture -- one of the most important U.S. naval installations in the Indo-Pacific -- American vessels have long undergone maintenance and servicing. The base hosts the U.S. Seventh Fleet's flagship, USS Blue Ridge, as well as the aircraft carrier USS George Washington.
Yokosuka's institutional depth dates back to the 19th century, when shipbuilding and repair facilities were first established and later developed into a major Imperial Japanese Navy logistics hub. Following World War II, the base evolved into a cornerstone of U.S. naval operations in the region -- a legacy that continues to reinforce Japan's operational familiarity with American naval systems today. As Washington evaluates long-term industrial partners, such accumulated experience may carry strategic weight.
If large-scale implementation of bilateral shipbuilding cooperation proceeds, competition between Seoul and Tokyo will likely intensify. What lies ahead is not simply commercial rivalry, but a structural contest for industrial positioning within the evolving Indo-Pacific maritime order. For both countries, the implications extend beyond contract volume to questions of credibility, reliability and long-term strategic alignment.
If competition with Japan is unavoidable, South Korea must respond with strategic discipline.
First, the National Assembly should act with urgency and coherence. During previous tariff negotiations with the United States, procedural delays weakened negotiating leverage and contributed to unfavorable outcomes. A repetition of such disorganization would risk undermining credibility at a pivotal moment. The bipartisan "MASGA Support Act," introduced last year to institutionalize Korea-U.S. shipbuilding cooperation, should be refined and advanced without delay. Its provisions -- including the establishment of a bilateral shipbuilding cooperation fund and legal frameworks facilitating the construction and maintenance of U.S. naval vessels in Korean shipyards -- are already structured. At this stage, execution carries strategic significance.
Second, the government must address structural vulnerabilities within the shipbuilding sector, particularly recurring labor instability. Reliability will be a decisive factor in Washington's assessment of long-term industrial partners. Should industrial disputes disrupt production during early phases of cooperation, reputational costs could be significant and enduring.
There are encouraging precedents. Late last year, Hanwha Ocean implemented a profit-sharing framework extending equal performance bonus ratios to approximately 15,000 employees of partner firms. Addressing wage disparities between direct hires and subcontracted workers has long been a structural challenge in Korean shipbuilding. By proactively strengthening internal coordination and operational stability, the company provided a model that aligns with the expectations of strategic industrial collaboration. Similar efforts across the sector would reinforce confidence.
Early trust-building may ultimately prove decisive. In strategic industrial cooperation, credibility established at the outset often shapes long-term allocation of projects and influence.
Japan appears to be moving with calculated speed. Following confirmation of a major U.S.-based energy investment as an initial project, discussions have circulated regarding potential next-generation reactor initiatives linked to U.S. naval assets stationed at Yokosuka. Whether such projects materialize or not, proactive signaling strengthens strategic posture. South Korea must ensure that it is perceived as initiating rather than reacting.
Rivalry between Seoul and Tokyo carries historical undertones, but in this emerging maritime framework the determining factor will not be sentiment. It will be preparedness. The coming competition will test legislative coordination, industrial stability and diplomatic agility.
In the reshaping of the Indo-Pacific maritime order, the margin between leadership and missed opportunity may be defined less by rhetoric than by readiness.
Nohsok Choi is the former chief editor of the Kyunghyang Shinmun and former Paris correspondent. He currently serves as president of the Kyunghyang Shinmun Alumni Association, President of the Korean Media & Culture Forum, and CEO of the YouTube channel One World TV. The views and opinions expressed in this commentary are solely those of the author.
6. North Korean Lazarus Group Now Working With Medusa Ransomware
Summary:
Symantec and Carbon Black report that north Korea linked Lazarus actors are now using Medusa ransomware and continue extortion attempts against the U.S. healthcare sector, despite prior U.S. indictment activity. Evidence shows Medusa used against a Middle East target and an unsuccessful attack on a U.S. healthcare organization. Medusa is a 2023 ransomware-as-a-service operated by Spearwing, with more than 366 claimed attacks. Medusa leak-site data shows four U.S. healthcare and nonprofit victims since early November 2025, though attribution to north Korean operatives is uncertain; average ransom demand was $260,000. The report links earlier healthcare-focused ransomware to Lazarus sub-group Stonefly and lists associated tools and indicators.
North Korean Lazarus Group Now Working With Medusa Ransomware
North Korean attackers continuing to mount extortion attacks against the U.S. healthcare sector despite indictment.
Threat Hunter Team
Symantec and Carbon Black
https://www.security.com/blog-post/lazarus-medusa-ransomware
- Threat Intelligence
- 24 Feb 2026
- 7 Min Read
Share
North Korean state-backed attackers are now using the Medusa ransomware and are continuing to mount extortion attacks on the U.S. healthcare sector.
North Korea has long been involved in ransomware attacks and has been previously associated with the Maui and Play ransomware families. However, the Symantec and Carbon Black Threat Hunter Team has uncovered evidence North Korean actors using Medusa in an attack on a target in the Middle East. The same attackers also mounted an unsuccessful attack against a healthcare organization in the U.S.
Medusa, which is operated by the Spearwing cybercrime group, was launched in 2023 and is run as a ransomware-as-a-service, where affiliate attackers can deploy the ransomware in exchange for a percentage of ransom payments. More than 366 attacks have been claimed by attackers using Medusa.
Analysis of the Medusa leak site reveals attacks against four healthcare and non-profit organizations in the U.S. since the beginning of November 2025. Victims included a non-profit in the mental health sector and an educational facility for autistic children. It is unknown if all these victims were targeted by North Korean operatives or if other Medusa affiliates were responsible for some of these attacks. The average ransom demand in that period was $260,000.
Figure 1. Claimed Medusa attacks, 2024-2026
History of extortion
One of the prime movers in mounting North Korean ransomware attacks in recent years has been the Lazarus sub-group Stonefly (aka Andariel). For many years, Stonefly was thought to be solely engaged in espionage attacks, particularly against high-value targets. However, the group became involved in ransomware attacks approximately five years ago. Its involvement in digital extortion came to public attention in July 2025, when the U.S. Justice Department indicted a North Korean man named Rim Jong Hyok on charges related to a ransomware campaign against U.S. hospitals and other healthcare providers. Rim is alleged to be a member of Stonefly, which is linked to the North Korean military intelligence agency, the Reconnaissance General Bureau (RGB).
The indictment shed some light on the motivation behind Stonefly’s move into ransomware. It alleged that the group was using the proceeds of ransomware attacks to fund its espionage activities, including attacks against the defense, technology, and government sectors in the U.S., Taiwan and South Korea.
The indictment, and a $10 million reward for information on Rim, did not appear to deter Stonefly from mounting further attacks. In October 2024, our Threat Hunter Team found evidence of intrusions against three different U.S. organizations. Although no ransomware was successfully deployed, the attacks appeared to be financially motived since all victims were private companies and involved in businesses with no obvious intelligence value.
In the same month, Palo Alto Unit 42 reported that it had begun collaborating with the Play ransomware group.
Attacker toolset
Lazarus is using a range of tools in its current ransomware campaigns. These include:
- Comebacker: A custom backdoor and loader exclusively associated with Lazarus.
- Blindingcan: A remote access Trojan (RAT) associated with Lazarus.
-
ChromeStealer: A tool for extracting stored passwords from the Chrome browser.
- Curl: An open-source command-line tool for transferring data using various network protocols.
- Infohook: Information-stealing malware.
-
Mimikatz: A publicly available credential dumping tool.
- RP_Proxy: A custom proxying tool.
Attribution
While the current Medusa ransomware attacks are undoubtedly the work of Lazarus, the blanket designation for North Korean state-sponsored activity, it is unclear which Lazarus sub-group is behind them. While the TTPs – extortion attacks against the U.S. healthcare sector – are like previous Stonefly attacks, the malware tools used are not exclusive to Stonefly. For example, the Comebacker backdoor has previously been reported to be associated with the Pompilus group (aka Diamond Sleet).
Few scruples
The switch to Medusa demonstrates that North Korea’s rapacious involvement in cybercrime continues unabated. North Korean actors appear to have few scruples about targeting organizations in the U.S. While some cybercrime outfits claim to steer clear of targeting healthcare organizations due to the reputational damage it may attract, Lazaurs doesn’t seem to be in any way constrained.
Protection/Mitigation
For the latest protection updates, please visit the Symantec Protection Bulletin.
Indicators of Compromise
If an IOC is malicious and the file available to us, Symantec Endpoint products will detect and block that file.
File indicators
15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10 - Medusa ransomware
0842dd5c1f79f313ea08c49d1fb227654c32485b3f413e354dbe47b8a519a120 - Comebacker
202b03d788df6a9d22bbd2cbc01ba9c7b4a9caad0f78a4d420f8c2c30171a08d - Comebacker
61f3b09bcbae2fc2c98ccac7b2a0becdf5ddb28fe6a8b9c679fd574d58f8ca40 – Comebacker
8f6866532abd8400d244d0441be097f8209065ac43d9f864b2a6894f9da2880a – Comebacker
a12c84dabaffa868507807c645f7f0769ac848cc575a8c3b42dfb791aa5caeef – Comebacker
bf27c5e2591febe90e52cd99231526a342bc423000fe87cce44ef1c3acaeeab5 - Comebacker
60b942bbdac625300eeb11cccba5ed44f376634f73d3bc01a17e7a758c570a8e - Comebacker Loader
7a22880780c74b212e36ebb871af4af26a620326c456cf96a3dfb1481ee436cc – Loader
ab3e3a8673ba5da40b325b160a782cf2f03547d9b489e87d9546da35a65d62d6 – SSH Loader
16d57ff889aab5b8c8a646da99d5a9335177fb4c158191baa1cf199f0e818d3a - File used for DLL sideloading
3e3e0519a154266da1558e324c9097e7c39ccf88f323f2f932f204871d1b91cb - RP_Proxy
60aaf6c01ba0c15b78902fd4be12c7e5f2323ade8f9db7e9fbbb9ec0c2afc8ba - RP_Proxy
7530323c3976687a329e06bb7b7f95017f2cfd408f6a5261cb2f0c6b6f18f081 - RP_Proxy
ce4fcb97ada09a42c03c3456c5fe09d805948a95efaf365eb1cd2b4e82013990 - RP_Proxy
db98d087d4cdb2a82096df424f86edea8d4730543a2005f43bede9ffc6123791 – Mimikatz
e24e4c949894b08a66b925b6c55f12d1b3c69adc95b79e99a31315e289d193fc - ChromeStealer
61c49c8f116cb7118dee613536085cfaa7a59d5f49c36b9ff432be7b8a7f25f0 – Credential Stealer
18049366331a5f0afd54c2ca84e6ed302e81d58a162673715fee865541d53b11 - Suspicious file
313ce75f0f47e2a8fd66120fcbcaa6226fc0c4862b585b8e04850153f97bc4a3 - Suspicious file
3b8850bad0cb3ebae477b3787844b892bb0e4f7bd9c9e8b507898a726e7e2763 - Suspicious file
416545b9e844d3d924e162951a8ee885f3885e054a196ccdc659fd9d1f1911a6 - Suspicious file
4a702c784eb997a170bea81778a770a86e61c759ff95ca0ad958ceca55c20c7b - Suspicious file
52293b53ca5209bc49f009288cf6fc80c9f787c9c735cc06e7dc6fc9fcdaf61d - Suspicious file
55cb4a851372237a5ba4bf187e37b0d599f3ffa13ac17464130744614353bd07 - Suspicious file
63432828de42e43ea3715157da5439c40e5c371eefd7c1892b25f396c1018cc8 - Suspicious file
6428ef885c54b8154bd86a5d849fb8cc8c04f39e72188117119b9e2832b99ee6 - Suspicious file
6ad1a57ce20b422b77bab84a8daebf4e7262543742b2fdcbcacde3f7780d9046 - Suspicious file
6ba46c392bdc330ceef2aeb984c63c89d673a090dd68d3258e4aa7e20e5c098d - Suspicious file
84168ee4e290690985358dfc497b98a22ef279a01179b93ff4e6c9c5e1ee26e4 - Suspicious file
918e2a5a01fdb0ad462b0242e4f23d51111031052a1ebd6a32d22be9cbd8dfb8 - Suspicious file
932b9ec79c782f06b3c8d267af916df41328ddb8235d021ea7f945dc4082d991 - Suspicious file
9cb10407ca3c9e8c1a069ebb4c677d8889117c1bc5206fbf16f47ebb13ef34b9 - Suspicious file
a670d8818a6efe2919c18c740ef4f3478551b28481d0a1591539be45ceca2171 - Suspicious file
a957b5dd5f555be8431df3f35b707c149b83436d19cc3f8bbd867317a6f624b1 - Suspicious file
b42345567556a01d34daf262f95fdeb02f259271afbea93fb684b9656d14e568 - Suspicious file
b8a9533a21127ff5005352d41581c5631598704e220120b623fad16e3ec2ae51 - Suspicious file
bf05b1ace61aeebd251940b40624fe22a345300fc6a53a472357f9586e8e4e57 - Suspicious file
c69acc7364da828f098394b1a6907788d4fd379ed2af7d966e86a2becea4c0ad - Suspicious file
cf5e38d65bef38654080635fcb76890e3e0548626b0598bc8090b18116220389 - Suspicious file
cfe33c6faacc824fcb475d450d6ba19316884fad4c85f563a330a86d03ecff0c - Suspicious file
d80daa7b30732b2b71d63a5881a254d12eb0d499a015dc4c98602caa2001d2a3 - Suspicious file
df1b9ec31fa4578dee7668207064de7185798801bb032c715aa24cce7e35bcda - Suspicious file
f0f4423cd8d5ceafb4e4a18014ff4ed8913021d83bc2c3a973a419b9fe466c19 - Suspicious file
fdd4b78aa4e0914f3bcdc2632338ebbd300fdc3f05a3df85a5a3067f97627e45 - Suspicious file
35a11a68b0ce862bdc7450735237e56cf70156870b0527ec624f0a57076c09c7 - Suspicious file
a55bc262c5218c6bdaebcf4618154312ff0540b00c382ab34e805699ce3fcc31 - Suspicious file
bedada1c52e9bcceff8c6b542d74518afcce66f955ac6f1ab58aa43b3865fe9f - Suspicious file
Network indicators
23.27.140[.]49
23.27.140[.]135
23.27.140[.]228
23.27.124[.]228
amazonfiso[.]com
human-check[.]com
illycoffee[.]my
illycafe[.]my
markethubuk[.]com
sictradingc[.]com
trustpdfs[.]com
zypras[.]com
About the Author
Threat Hunter Team
Symantec and Carbon Black
The Threat Hunter Team is a group of security experts within Broadcom whose mission is to investigate targeted attacks, drive enhanced protection in Symantec and Carbon Black products, and offer analysis that helps customers respond to attacks.
7. ROK envoy urges North Korea to comply with nuclear treaty, return to talks
Summary:
South Korea’s nuclear envoy Jeong Yeon-doo urged north Korea at the Conference on Disarmament in Geneva to comply with the Nuclear Non-Proliferation Treaty and U.N. Security Council resolutions and to return to dialogue, reaffirming Seoul’s commitment to “complete denuclearization” and a three-phase talks-based approach with the United States and partners. Jeong warned that global security is deteriorating and argued nuclear-weapon state dialogue is needed to reduce miscalculation and rebuild trust through transparency. The call came as a senior north Korean official defended Kim Jong Un’s nuclear buildup and as Pyongyang again rejected denuclearization demands. South Korea also raised humanitarian issues and detainees at the U.N. Human Rights Council.
Comment: I can only think of 14 words in response;
UUnification first, then denuclearization; the path to unification is through information and human rights.
ROK envoy urges North Korea to comply with nuclear treaty, return to talks
Jeong Yeon-doo reiterates Seoul’s commitment to ‘complete denuclearization’ at high-level meeting in Geneva
Jooheon Kim February 24, 2026
https://www.nknews.org/2026/02/rok-envoy-urges-north-korea-to-comply-with-nuclear-treaty-return-to-talks/
North Korea simultaneously launches 18 missiles. | Image: Rodong Sinmun (May 2024)
Seoul’s nuclear envoy urged North Korea to comply with the landmark international treaty constraining nuclear development and return to dialogue on Monday, reiterating the South’s commitment to peace and denuclearization.
Vice Minister for Diplomatic Strategy and Intelligence Jeong Yeon-doo made the call for Pyongyang to abide by the Nuclear Non-Proliferation Treaty (NPT) and U.N. Security Council resolutions during a high-level session of the Conference on Disarmament held Monday in Geneva, according to Seoul’s foreign ministry.
Seoul has consistently pursued “complete denuclearization” of the Korean Peninsula, Jeong said, adding that South Korea will work closely with the U.S. and other partners on South Korea’s three-phase approach to the denuclearization through talks.
President Lee Jae Myung previously outlined a strategy of seeking to freeze the North’s nuclear and missile programs, reduce their numbers and ultimately achieve denuclearization.
Jeong warned that the current international security environment has deteriorated and that instability has become the norm, noting that “the disarmament and non-proliferation” regime is facing serious challenges.
“Continued dialogue among nuclear-weapon states is essential to enhance strategic predictability, reduce the risk of miscalculation, and rebuild trust through greater transparency,” he said.
The Conference on Disarmament is a multilateral forum for disarmament negotiations. It has served as the birthplace of the NPT and the Comprehensive Nuclear-Test-Ban Treaty (CTBT).
The NPT was enacted in 1970 and aims to prevent the spread of nuclear weapons by restricting their possession to the five countries on the U.N. Security Council — the U.S., Russia, China, the U.K. and France.
While North Korea became a party to the treaty in 1985, it later announced its withdrawal in 2003.
Jeong’s statement came after senior North Korean official Ri Il Hwan defended leader Kim Jong Un for committing to nuclear weapons development during the ongoing Ninth Party Congress this week.
The DPRK has repeatedly insisted that it is a nuclear state and will never give up its weapons of mass destruction.
While Pyongyang has rejected all contact with the South, Kim said last year that he’s willing to discuss “peaceful coexistence” with U.S. President Donald Trump if Washington gives up its “absurd obsession with denuclearization.”
Vice Minister for Diplomatic Strategy and Intelligence Jeong Yeon-doo speaks in Geneva on Feb. 23, 2026. | Image: Ministry of Foreign Affairs, Republic of Korea
SEPARATED FAMILIES AND DETAINEES
On the same day, South Korea’s Second Vice Foreign Minister Jina Kim stated at the U.N. Human Rights Council in Geneva that Seoul will pursue inter-Korean dialogue to address humanitarian issues, including separated families, abductees, detainees and prisoners of war.
She also emphasized that South Korea will work closely with the international community to achieve improvements in the human rights of North Koreans.
Kim met with U.N. Deputy High Commissioner for Human Rights Nada Al-Nashif to discuss ways to strengthen cooperation on North Korean human rights issues. She also held talks with Pierre Krähenbühl, director-general of the International Committee of the Red Cross.
At least seven South Koreans, including several missionaries, are believed to be detained in North Korea, U.N. Special Rapporteur Elizabeth Salmón said at a press conference earlier this month.
Seoul’s top security official told NK News in December that South Korea is willing to discuss the repatriation of long-time, unconverted North Korean prisoners of war amid efforts to secure the release of ROK nationals held in the DPRK.
After the 1953 armistice that ended active fighting in the Korean War, Pyongyang repatriated less than half of the roughly 82,000 South Korean prisoners of war who had been held in the North at the time, according to experts.
Last month, six surviving South Korean POWs sent a letter to Salmón asking her to push the ROK government to finally deal with the still unresolved POW issue.
Last week, they urged the ROK government to set up a commission to look into issues related to South Korean POWs and publish an official report, Son Myeong-hwa, a daughter of one of the POWs, told NK News.
Edited by Bryan Betts
8. Column: Role of U.S. Forces Korea already shifting
Summary:
Kim Myeong-ho, a Korean academic, argues U.S. Forces Korea’s role is already shifting as U.S.-China rivalry intensifies, and Seoul should accept this while protecting core national interests. He cites recent aerial standoffs near overlapping air defense identification zones in the Yellow Sea involving U.S. F-16s from Osan and Chinese aircraft, alongside nearby U.S.-Japan drills featuring B-52s. These developments, plus remarks attributed to Bridge Colby on building a “line of denial” tied to the First Island Chain, and past comments by USFK commander Xavier Brunson, indicate “strategic flexibility” moving from North Korea-focused deterrence toward broader China containment. He urges Seoul to use industrial strengths, especially semiconductors, to build an economic security framework.
Comment: If the peninsula is being pulled into a Taiwan-Okinawa-Korea denial line, then alliance risk grows even when north Korea is quiet, because the trigger can be air and maritime friction, not just north Korean missiles. This is bargaining power disguised as danger, since semiconductors, shipbuilding, and energy become leverage to shape U.S. and China choices, but only if Seoul moves first and stays coherent. “Strategic flexibility” cuts both ways, because it can widen deterrence options, yet it can also widen the target set on Korean soil when Washington and Beijing treat the West Sea/Yellow Sea as a proving ground. This is the Korean "shrimp among whales" fear that most of us fail to grasp or respect.
World News Feb. 23, 2026 / 11:59 PM / Updated at 12:07 AM
Column: Role of U.S. Forces Korea already shifting
By Asia Today and translated by UPI
https://www.upi.com/Top_News/World-News/2026/02/23/us-forces-korea-role-changes-korean-academic-said/7711771908721/
A US F-16 fighter jet lands at an air base in Gwangju, South Korea, 18 April 2025, a day after South Korea and the United States kicked off the two-week Freedom Flag exercise in efforts to bolster their interoperability and combined readiness posture against North Korean threats. File. Photo by YONHAP / EPA
Feb. 23 (Asia Today) -- The role of U.S. Forces Korea has already changed amid intensifying U.S.-China rivalry, and Seoul must acknowledge that reality while focusing on core national interests, a Korean academic wrote in a column published Sunday.
Kim Myeong-ho, a visiting professor at Konkuk University, argued that recent aerial standoffs between U.S. and Chinese fighter jets over waters near the Korean Peninsula signal a qualitative shift in the U.S.-South Korea alliance.
U.S. Air Force F-16 fighter jets based at Osan Air Base flew near overlapping air defense identification zones in the Yellow Sea earlier this month, prompting a response from Chinese aircraft, according to the column. Around the same time, U.S.-Japan joint exercises involving B-52 strategic bombers took place in nearby waters.
Kim wrote that such developments show the Korean Peninsula has become a frontline in strategic competition between Washington and Beijing, rather than solely a theater focused on deterring North Korea.
Related
He cited remarks by Elbridge Colby, the U.S. deputy secretary of defense for policy, who during a recent visit to Seoul emphasized building a "strong line of denial" against China's military modernization. The comments referenced the so-called First Island Chain linking Taiwan, Okinawa and the Korean Peninsula.
Kim also pointed to past comments by Xavier Brunson, commander of U.S. Forces Korea, that the force is not solely focused on North Korea but plays a broader role within the Indo-Pacific strategy.
According to the column, these moves reflect a shift from North Korea-centered deterrence to broader containment of China, with "strategic flexibility" now being implemented in practice.
Kim warned that South Korea sits at the edge of the First Island Chain, where U.S. and Chinese strategic interests intersect, including critical semiconductor supply lines.
He argued that Seoul's response must go beyond rhetorical disputes and instead leverage strengths in semiconductors, shipbuilding, nuclear energy, defense and petrochemicals to secure advantageous arrangements with major powers.
"The only way to avoid strategic vulnerability is to maximize our leverage through global competitiveness," Kim wrote, urging the government to establish a strong economic security framework to safeguard national interests.
-- Reported by Asia Today; translated by UPI
© Asia Today. Unauthorized reproduction or redistribution prohibited.
Original Korean report: https://www.asiatoday.co.kr/kn/view.php?key=20260223010006718
9. Joint Interagency Task Force Announces Counter-UAS Marketplace
Comment: This is procurement as operational tempo, because the marketplace tries to turn counter-UAS buying from a slow staff ritual into a repeatable, near-fielding action.
The joint force is transforming in contact.
Joint Interagency Task Force Announces Counter-UAS Marketplace
Feb. 24, 2026 | By Joint Interagency Task Force 401 |
https://www.war.gov/News/News-Stories/Article/Article/4413359/joint-interagency-task-force-announces-counter-uas-marketplace/
Joint Interagency Task Force 401 announced today that its revolutionary counter-unmanned aircraft systems marketplace has reached initial operational capability.
The online platform, hosted on the common hardware systems electronic catalog, will revolutionize how the War Department and its interagency partners acquire critical counter-UAS technology.
The marketplace streamlines the process for users to identify and procure the right equipment to meet their specific needs, featuring a growing catalog of validated counter-UAS systems and components, with plans to include performance data from the task force's authoritative test and evaluation repository. It allows customers to compare systems based on real-world performance against a variety of threats and in different environments.
"The JIATF 401 [counter]-UAS marketplace is a critical step forward in our whole-of-government approach to countering the threat of small drones," said Army Brig. Gen. Matthew Ross, JIATF 401 director. "Our goal is to integrate sensors, effectors and mission command systems into a responsive, interoperable network that protects service members and American citizens alike."
The marketplace is built on an established indefinite delivery, indefinite quantity contract, enabling customers to place orders immediately and significantly reducing the lengthy contracting process typically associated with defense procurement. The common hardware systems website provides an intuitive interface for users to browse available equipment, review technical specifications and compare pre-negotiated contract options.
"Building and maintaining the [counter]-UAS marketplace has been a collaborative effort focused on delivering a user-friendly and effective tool for the warfighter," said Army Maj. Matt Mellor, the lead acquisitions specialist assigned to JIATF 401. "We've worked to create a platform that not only simplifies the procurement process but also provides the crucial data and expert support necessary for our customers to make informed decisions. This is about getting the best technology into the hands of those who need it as quickly as possible."
The marketplace is actively expanding its inventory to include all validated counter-UAS equipment not already designated as a program of record. The common hardware systems electronic catalog already lists over 1,600 items, demonstrating its capacity to support a comprehensive, growing selection of counter-UAS solutions.
Access to the marketplace is available to users throughout the War Department and interagency partners via a common access card or other government-issued smart card.
10. USFK chief expresses 'regret' to Seoul defense minister over air standoff incident with China
Summary:
USFK said Gen. Xavier Brunson told South Korea’s defense minister he regretted that the minister and the JCS chairman were not briefed in time about a U.S. Air Force drill over the West Sea/Yellow Sea that coincided with a rare U.S. China fighter standoff. USFK stressed it had provided prior notification to South Korean counterparts, while emphasizing it does not “apologize” for readiness training. Yonhap reports the drill involved about 10 F-16s operating near overlapping air defense identification zones, prompting China to scramble fighters; no clash occurred. After Seoul complained, the exercise reportedly ended early.
Comment: This is a process foul (timely senior-level reporting) more than an operational rupture, but Seoul is treating it as a sovereignty and crisis-control issue. USFK’s “regret not apology” language is aimed at preventing China from reading allied training as politically constrained. We must remember that a major objective of both the PRC and north Korea is to drive a wedge in the alliance. We must not do that to ourselves otherwise we are giving a victory to their political warfare efforts.
(LEAD) USFK chief expresses 'regret' to Seoul defense minister over air standoff incident with China | Yonhap News Agency
en.yna.co.kr · Kim Hyun-soo · February 24, 2026
https://en.yna.co.kr/view/AEN20260224011051315?section=national/defense
(ATTN: CHANGES headline; UPDATES throughout with USFK statement)
SEOUL, Feb. 24 (Yonhap) -- The commander of the U.S. Forces Korea (USFK) has expressed "regret" to the South Korean defense minister that he was not briefed on the recent U.S. Air Force drills over the Yellow Sea on time, the USFK said Tuesday.
Gen. Xavier Brunson made the remarks during a phone call with Defense Minister Ahn Gyu-back last week to discuss the situation surrounding the U.S. Air Force drill staged from last Wednesday to Thursday.
In a statement to the press, the USFK said the commander had spoken directly with Ahn to reiterate that "notification had been provided to the Republic of Korea side," and expressed regret that the defense minister and the chairman of the Joint Chiefs of Staff (JCS) "were not briefed in time."
"U.S. Forces Korea conducts regular training to maintain the highest level of readiness and ensure it can fulfill its mission," it said in the statement, adding, "We don't make apologies for maintaining readiness."
The USFK commander also spoke with JCS Chairman Gen. Jin Yong-sung and shared his professional assessment on matters affecting readiness, it said, without elaborating.
The statement came after U.S. and Chinese fighter jets engaged in a rare standoff over the Yellow Sea during a U.S. Air Force training operation that involved some 10 USFK F-16 fighter jets.
The F-16 jets reportedly flew to an area between the respective air defense identification zones of South Korea and China, prompting the Chinese military to dispatch its own fighter jets to the scene, but no clash occurred.
Following the incident, Ahn reportedly lodged a complaint in a call with Brunson last Thursday over the failure to share details of the exercise with South Korean authorities in advance.
The incident led the U.S. military to end the exercise on Thursday, earlier than the planned end on Saturday.
In this file photo, Gen. Xavier Brunson, commander of the U.S. Forces Korea, leaves a gathering with Foreign Minister Cho Hyun and U.S. Under Secretary of Defense for Policy Elbridge Colby in Seoul on Jan. 26, 2026. (Yonhap)
sookim@yna.co.kr
(END)
en.yna.co.kr · Kim Hyun-soo · February 24, 2026
11. USFK Denies Apology Over West Sea Exercise Standoff
Summary:
USFK publicly rejected South Korean claims that Gen. Xavier Brunson “apologized” for a recent West Sea air exercise that triggered a brief standoff with Chinese fighters. USFK said Brunson reaffirmed that prior notification of the training had been provided to South Korean authorities, but expressed regret that the incident was not reported quickly to the defense minister and JCS chairman. USFK stressed it “does not apologize for maintaining readiness” and criticized selective disclosures of private senior leader conversations. The episode intersects with Seoul’s push to restore parts of the Sept. 19 inter-Korean military agreement, including no-fly zones.
Comment: First, the alliance’s friction point is shifting from “what happened” to “who controlled the narrative,” and that can erode trust faster than the operational incident itself. Second, USFK is (correctly I strongly believe) signaling it will resist readiness constraints tied to revised no-fly zones, even if Seoul frames them as risk management.
USFK Denies Apology Over West Sea Exercise Standoff
USFK clarifies regret over delayed reporting, not apology, in communication with South Korean officials
By Kim Dong-ha
Published 2026.02.24. 23:40
Updated 2026.02.25. 01:38https://www.chosun.com/english/national-en/2026/02/24/WXMJZBNVMVFMDCRINTZUZGT6VI/
Xavier Brunson, Commander of USFK, leaves the Four Seasons Hotel in Jongno-gu, Seoul, after a breakfast meeting with Elbridge Colby, U.S. Under Secretary of Defense for Policy, and Foreign Minister Cho Hyun on the 26th. /News1
The United States Forces Korea (USFK) strongly refuted claims by South Korean military authorities that Commander Xavier Brunson had apologized to the South Korean government regarding a recent aerial exercise over the West Sea that led to a standoff with Chinese fighter jets, in a statement released late on the 24th. It is unusual for USFK to issue a statement in the middle of the night.
USFK stated on the same day, “Commander Xavier Brunson directly communicated with Defense Minister Ahn Gyu-back to reconfirm that prior notification had been provided to the South Korean side regarding the incident,” adding, “However, we expressed regret over the failure to report the matter in a timely manner to the Defense Minister and the JCS Chairman.” This is interpreted as USFK asserting that it had notified South Korean military authorities in advance about the training plan.
Earlier, USFK conducted a large-scale exercise from the 18th to the 19th, dispatching F-16 fighter jets from Osan Air Base over the West Sea. At the time, Chinese fighter jets responded, leading to a temporary standoff between U.S. and Chinese aircraft over the West Sea.
Defense Minister Ahn Gyu-back reportedly received a briefing on the situation and directly protested to Commander Brunson via phone on the 19th. Subsequent reports claimed that Commander Brunson had apologized to South Korea over the USFK’s West Sea aerial exercise, which caused the standoff with Chinese fighter jets.
Regarding this, Defense Ministry spokesperson Jeong Bit-na stated during a briefing that morning, “Disclosure of the call’s content is limited,” but added, “We understand that the report is partially factual.”
However, USFK countered, “USFK conducts regular training to maintain the highest level of readiness and fulfill its missions,” and “We do not apologize for maintaining readiness.” This directly refutes the Defense Ministry’s claims.
USFK also revealed that Commander Brunson had spoken not only with Defense Minister Ahn but also with JCS Chairman Jin Yong-sung. Regarding reports that Commander Brunson expressed concerns over South Korea’s push to restore the September 19 inter-Korean military agreement—including the readjustment of no-fly zones—as “restricting the South Korean military’s own readiness,” USFK expressed regret.
USFK stated, “We do not comment on private discussions between senior leaders,” and “Frank dialogue is essential for effective alliance coordination, and selective disclosure of information, regardless of its accuracy, does not help achieve our shared security goals.”
It added, “Commander Brunson shared his professional assessment on matters affecting readiness during the call with the JCS Chairman,” and “Commander Brunson remains firmly committed to the ROK-U.S. combined defense posture and robust deterrence.”
The Defense Ministry had previously announced plans to consult with the U.S. side, including USFK, regarding the restoration of the September 19 military agreement, such as establishing no-fly zones. To address intelligence gaps caused by no-fly zones, support from U.S. reconnaissance assets is necessary, and since USFK is also subject to these measures, prior consultations between South Korea and the U.S. are essential. However, a high-ranking official from the Ministry of Foreign Affairs stated on the same day, “The U.S. has not yet agreed.”
12. North Korea hands out Russian flour for Kim Jong Il’s birthday
Summary:
Ahead of Feb. 16, north Korean authorities in Hamhung distributed wheat flour imported from Russia to party committees, security and police bodies, army units, mines, and other state institutions, with neighborhood watch units told they will receive flour later. People welcomed any provisions but complained that powerful organizations again received priority while ordinary families remain insecure. The amounts were small, about 5 kilograms per recipient, useful for a few days of snacks rather than daily staples, driving calls for rice instead. The report links the flour push to Kim Jong Un’s stated policy of shifting diets toward wheat, even as citizens say immediate food stability remains unmet.
Comment: The regime is using holiday-linked “gifts” to signal care while keeping distribution politically weighted toward coercive and production organs. Wheat imports from Russia likely serve dual purposes: limited ration relief and inputs for state-run food sales meant to raise hard currency.
North Korea hands out Russian flour for Kim Jong Il’s birthday
Many North Koreans say they would rather have rice than flour
dailynk.com · February 23, 2026
https://www.dailynk.com/english/north-korea-hands-out-russian-flour-for-kim-jong-ils-birthday/
Rodong Sinmun reported on Sept. 4, 2025, that "Comrade Kim Jong Un met and held talks with Russian President Vladimir Putin, who participated in the 80th anniversary commemoration of the Chinese People's War of Resistance Against Japan and the World Anti-Fascist War Victory, at the Diaoyutai State Guesthouse in Beijing on the afternoon of the Sept. 3." (Rodong Sinmun·News1)
North Korean authorities distributed wheat flour imported from Russia to government agencies, army units, mines and other state institutions in Hamhung, South Hamgyong province ahead of Kim Jong Il’s birthday on Feb. 16, though many people say the state should be prioritizing rice over flour.
According to a Daily NK source in South Hamgyong province, who requested anonymity for security reasons, rumors that North Korea had imported large amounts of Russian flour had recently spread in Hamhung. In line with this, authorities distributed flour ahead of the late leader’s birthday to party committees, security and police agencies, army units and mines.
An order was also issued to distribute flour to neighborhood watch units, though a specific date has not yet been set. Public anticipation is growing in response.
“With some agencies actually receiving flour provisions and neighborhood watch units reportedly set to receive them after recent rumors about flour imports, people welcome the news, with their worries about food eased a bit,” the source said.
However, some people complain that powerful agencies “have never worried about putting food on the table, yet they always receive priority provisions,” and that they wish “ordinary families received provisions first in times like these.”
Others say Korean people “can work only when they eat rice” and that it would be “far better to import rice rather than flour.”
Rations fall short of people’s needs
Limited provision volumes are fueling these responses. People at powerful agencies, army units and coal mines received an average of 5 kilograms (11 pounds) of flour.
“If you receive enough to feed your family, nobody would turn down provisions of flour, regardless of whether they exchange it for rice or consume it themselves,” the source said. “Five kilograms is enough for donuts or fritters for a couple of days, but even these are special foods for occasional consumption. You can’t eat them every day. So the joy at receiving flour is brief, and people express a desire for rice.”
During a policy speech at the Fifth Meeting of the 14th Supreme People’s Assembly in September 2019, North Korean leader Kim Jong Un stressed the need to ensure that people have “polished rice and flour, and thus provide them with the condition for improving their diet in a cultured way.” Later that year, at the Fourth Plenary Meeting of the Eighth Central Committee in December, Kim called for policies to shift the country’s dietary structure in favor of wheat, urging “ways to orient the agricultural production of the country to replacing the people’s culture of diet by that with the main stress on polished rice and flour foods.”
Policies to shift the country’s diet toward wheat align with Pyongyang’s foreign policy strategy of drawing close to Russia. However, as there are limits to replacing the country’s rice- and corn-focused dietary culture, which has taken root over decades, people point out that a large gap persists between the authorities’ policies and reality.
“Above all else, what is most urgent right now is stabilizing people’s day-to-day food supply,” the source said. “The state is doing lots of things ostensibly to improve lives, but the most important problem people face — food — has yet to improve.”
Some people say that much of the flour recently imported from Russia is intended to supply food factories rather than for public distribution.
“There’s a rumor that the country imported flour from Russia for gifts on Feb. 16 and April 15,” the source said. “Many people also say that the state aims to boost revenue by selling snacks and bread products.”
NK News, quoting a press release by Russia’s federal veterinary customs authorities, reported on Jan. 27 that 540 tons (595 short tons) of flour produced in Novokuznetsk in Russia’s Kuzbass region was shipped to North Korea after undergoing quality control checks on Jan. 3, 19 and 20.
Read in Korean
A Note to Readers
Daily NK operates networks of sources inside North Korea who document events in real-time and transmit information through secure channels. Unlike reporting based on state media, satellite imagery, or defector accounts from years past, our journalism comes directly from people currently living under the regime.
We verify reports through multiple independent sources and cross-reference details before publication. Our sources remain anonymous because contact with foreign media is treated as a capital offense in North Korea—discovery means imprisonment or execution.
This network-based approach allows Daily NK to report on developments other outlets cannot access: market trends, policy implementation, public sentiment, and daily realities that never appear in official narratives. Maintaining these secure communication channels and protecting source identities requires specialized protocols and constant vigilance.
Daily NK serves as a bridge between North Koreans and the outside world, documenting what’s happening inside one of the world’s most closed societies.
dailynk.com · February 23, 2026
De Oppresso Liber,
David Maxwell
Vice President, Center for Asia Pacific Strategy
https://apstrategy.org/
Executive Director, Korea Regional Review
https://www.upi.com/Korea-Regional-Review/
Editor-at-large, Small Wars Journal
https://smallwarsjournal.com/
Twitter: @davidmaxwell161
Phone: 202-573-8647
email: david.maxwell161@gmail.com
| 
