North Korea Security Report — September 24, 2026

Security analysis based on open-source intelligence and web research. Period: September 17 — September 24, 2026.

Executive Summary

During the period of September 17-24, 2026, North Korea demonstrated an assertive and defiant security posture, marked by significant military activities and deepening strategic alliances. Pyongyang launched multiple ballistic missiles in response to ongoing US-led military exercises, while simultaneously reaffirming its irreversible nuclear status and threatening "more offensive" actions. A critical development was the formal opening of the first road bridge connecting North Korea and Russia, symbolizing a rapidly strengthening bilateral relationship that includes military assistance and technology transfer. Concurrently, international security agencies issued warnings about sophisticated North Korean cyberattacks targeting global job seekers for cryptocurrency and data theft. These developments underscore North Korea's commitment to enhancing its military capabilities and leveraging new partnerships to counter perceived threats, significantly impacting regional stability and challenging international denuclearization efforts.

Key Security Developments

• Ballistic Missile Launches in Response to Drills
  On September 20, 2026, North Korea launched two short-range ballistic missiles (SRBMs) from its eastern coastal Wonsan area towards the East Sea (Sea of Japan). The first missile flew approximately 450 kilometers, and the second, launched about three hours later, traveled over 600 kilometers, both landing outside Japan's exclusive economic zone. These launches followed a previous integrated firepower exercise on September 12, which involved ballistic missiles, cruise missiles, attack drones, and large-caliber rocket artillery, and were explicitly a response to the US-led "Pacific Vanguard 2026" multinational naval exercise and other trilateral drills involving the US, South Korea, and Japan. The launches highlight North Korea's continued development of diversified strike capabilities and its intent to respond forcefully to perceived provocations.

• Deepening Russia-North Korea Strategic Partnership
  A significant geopolitical shift was underscored by the ceremonial opening of the first road bridge between Russia and North Korea on September 7, 2026, connecting Russia's Khasan with North Korea's Rason special economic zone. This infrastructure development, reported on September 17, facilitates increased economic and military exchanges, including the low-profile transport of military equipment and North Korean labor to Russia. The relationship is formalized by a June 2024 mutual-defense treaty, with Russia providing cash, energy, and technology in exchange for North Korean manpower and arms. North Korea has reportedly sent over 16,000 troops to Russia since October 2024 and supplied more than 15 million rounds of 152mm shells, with Russia expanding sharing of space, nuclear, and missile-applicable technology.

• Reaffirmation of Nuclear Status and Threats of "More Offensive" Response
  North Korea's Vice Foreign Minister Kim Yo Jong, sister of leader Kim Jong Un, issued a strong warning on September 18, 2026, stating that Pyongyang would continue strengthening its nuclear deterrence and respond with "proportional or more offensive" actions to US-led military exercises. She criticized the "Pacific Vanguard 2026" exercise near Guam as a "frantic military move" and the "main source" of escalating tensions. This rhetoric was reinforced by North Korea's Vice Defense Minister Kim Kang Il at China's Xiangshan security forum on September 16, who asserted that a US arms buildup justified North Korea's efforts to strengthen its nuclear forces. Pyongyang also dismissed a resolution by the International Atomic Energy Agency (IAEA) criticizing its nuclear program, reiterating that its status as a nuclear power is irreversible.

• Global Cyberattacks by WaterPlum Hacking Group
  International security agencies from the US, Japan, Australia, and Germany issued a joint advisory on September 18, 2026, warning about the North Korea-linked hacking group "WaterPlum" (also known as "Contagious Interview"). The group infiltrated over 30,000 devices in more than 100 countries between December 2025 and July 2026 by posing as prospective employers, particularly in AI, cryptocurrency, and NFT firms. They stole over $10.7 million (1.7 billion Japanese yen) in cryptocurrency from more than 7,000 wallets. The attacks involved malicious files disguised as coding assignments or video-conferencing fixes, and the group is believed to operate under the 313 General Bureau of the Munitions Industry Department.

• Diplomatic Engagement at UN General Assembly
  North Korea's Vice Foreign Minister Kim Son-gyong departed for New York to attend the 81st session of the United Nations General Assembly, with her address scheduled for September 28. This marks a significant diplomatic presence, as she previously stated in 2025 that North Korea would "never give up our nuclear weapons." Her attendance comes amidst signals from US President Donald Trump about a willingness to resume summit diplomacy with Kim Jong Un, and South Korean President Lee Jae Myung's efforts to facilitate renewed dialogue between Pyongyang and Washington.

• South Korea's Push for Dialogue and Phased Denuclearization
  South Korean President Lee Jae Myung, during his address to the UN General Assembly and a sideline summit with US President Donald Trump on September 22, 2026, urged a resumption of US-North Korea talks. Lee proposed a phased approach to denuclearization, starting with a halt to North Korea's nuclear and missile advancements, followed by reductions and eventual denuclearization. This represents a departure from previous demands for immediate denuclearization and aims to leverage Trump's past relationship with Kim Jong Un to break the current deadlock.

• Continued Nuclear Program Expansion
  The International Atomic Energy Agency (IAEA) reported signs of possible expansion at North Korea's Yongbyon nuclear complex. Additionally, North Korea reportedly began operations in the Kangson enrichment facility in January 2026, which was constructed in 2024. These developments indicate North Korea's ongoing efforts to increase its nuclear production and strengthen the survivability of its nuclear forces, further solidifying its stance as a nuclear-armed state.

• Military Modernization and Production Increase
  In early June 2026, Kim Jong Un ordered a 2.5-fold increase in the production of ballistic and cruise missiles. North Korea is also actively developing new models of ballistic and cruise missiles for various launch platforms, including the Hwasal-2 cruise missiles and the Pulhwasal-3-31, designed for maritime launches from surface ships and submarines. This push for increased production and diversification of missile systems aims to improve North Korea's ability to penetrate South Korea's integrated air and missile defense network, potentially through hypersonic glide vehicles.

Geopolitical Impact and Regional Dynamics

North Korea's recent actions have significantly heightened regional tensions and reshaped its diplomatic landscape. The deepening military and economic ties with Russia, highlighted by the opening of the first road bridge, represent a critical strategic shift. This partnership provides Pyongyang with a vital lifeline against international sanctions and potentially access to advanced military technology, including space, nuclear, and missile-applicable expertise, in exchange for munitions and troops for Russia's war in Ukraine. This alignment challenges the efforts of the United States, South Korea, and Japan to isolate North Korea and complicates regional security dynamics, as Russia has ceased implementing UN Security Council resolutions against Pyongyang.

The increased frequency and assertiveness of North Korea's missile launches, particularly in response to US-led military exercises, underscore a cycle of escalation on the Korean Peninsula. Pyongyang's explicit threats of "more offensive" responses and its unwavering commitment to its nuclear program aim to deter intervention and force international recognition of its nuclear status. This stance directly contradicts the denuclearization goals of the US and South Korea, making any future dialogue extremely challenging. While South Korea and the US are attempting to revive diplomacy, North Korea's current actions suggest a firm rejection of denuclearization as a precondition for talks.

China's role in this evolving dynamic is complex. While Beijing has historically been North Korea's primary security guarantor, the burgeoning Russia-North Korea alliance might be occurring, in part, at Beijing's expense. However, China also seeks to prevent North Korea from tilting towards the United States and wants to maintain stability without "extremely provocative behavior." The US-China summit on September 24, 2026, is not expected to yield significant breakthroughs on North Korea due to divided strategic interests. The ongoing cyberattacks by North Korea also pose a global threat, demonstrating Pyongyang's capability to generate illicit revenue and potentially conduct espionage, further complicating international efforts to curb its destabilizing activities.

Military and Defense Analysis

North Korea's military posture during this period reflects a clear strategy of asymmetric deterrence and offensive capability enhancement. The September 20 ballistic missile launches from Wonsan, following an integrated firepower exercise on September 12, demonstrate a focus on developing and showcasing diverse strike capabilities, including ballistic missiles, cruise missiles, attack drones, and large-caliber rocket artillery. This integration of various weapon systems under a unified fire-control system aims to overwhelm enemy air defenses, particularly those of South Korea and the United States. The reported pursuit of hypersonic glide vehicles further indicates an ambition to improve missile penetration capabilities against advanced defense networks.

Defense spending trends are difficult to ascertain directly, but Kim Jong Un's order in early June 2026 to increase ballistic and cruise missile production by 2.5 times clearly signals a significant allocation of resources towards military modernization. The development of new missile models, such as the Hwasal-2 cruise missiles and the maritime-launched Pulhwasal-3-31, indicates a strategic shift towards diversifying launch platforms and enhancing survivability. The deepening military cooperation with Russia, including the deployment of North Korean troops to Russia and the exchange of munitions for potential technology transfer, suggests a concerted effort to acquire advanced military capabilities and offset technological gaps. This external support could significantly accelerate North Korea's weapons programs, particularly in areas like space, nuclear, and missile technology.

Outlook and Forecast

Short-term trends (1-3 months): North Korea is expected to maintain its assertive stance, continuing to conduct missile tests and issue strong rhetoric in response to perceived threats from the US and its allies. The newly solidified road link with Russia will likely see increased traffic, potentially facilitating more overt military and economic exchanges. Diplomatic efforts to engage North Korea, particularly those initiated by South Korea and the US, are unlikely to yield immediate breakthroughs, as Pyongyang remains committed to its nuclear status and demands a shift in US policy. Cyberattacks by North Korean groups like WaterPlum are highly probable to continue, as these activities are a crucial source of illicit revenue for the regime's weapons programs.

Critical flashpoints and risk areas: The primary flashpoint remains the Korean Peninsula, particularly around the Demilitarized Zone (DMZ) and the East Sea (Sea of Japan), where North Korean missile launches and allied military exercises frequently occur. Any miscalculation or escalation during these military activities could lead to a direct confrontation. The deepening Russia-North Korea military alliance, including potential transfers of sensitive technology, poses a significant risk of further destabilizing the region and undermining international non-proliferation efforts. The ongoing cyber campaigns also present a risk of broader economic disruption and intellectual property theft globally.

Indicators to monitor: Key indicators include the frequency and type of North Korean missile launches, especially any tests involving new or advanced capabilities like hypersonic vehicles or submarine-launched missiles. Monitoring the volume and nature of traffic across the new Russia-North Korea road bridge will be crucial for assessing the extent of their military and economic cooperation. Statements from North Korean officials regarding denuclearization and US-ROK-Japan military exercises will provide insight into their diplomatic posture. Additionally, vigilance for new cybersecurity advisories related to North Korean hacking groups will indicate the ongoing threat landscape.

Strategic recommendations: International actors should maintain a unified front in condemning North Korea's illicit activities and upholding sanctions, while also exploring avenues for dialogue that acknowledge the current geopolitical realities. Strengthening cyber defenses and intelligence sharing among allied nations is essential to counter North Korea's sophisticated hacking operations. For the US and South Korea, a flexible diplomatic approach, such as the phased denuclearization proposed by South Korea, might be necessary to create space for engagement, even if full denuclearization remains a long-term goal. Countering the Russia-North Korea alliance requires a coordinated international strategy, including diplomatic pressure and targeted sanctions, to limit the transfer of military technology and resources.

Sources

• bastillepost.com
• japantimes.co.jp
• tbsnews.net
• mysanantonio.com
• unn.ua
• nexuswild.com
• facebook.com
• bssnews.net
• muslimnetwork.tv
• militarywatchmagazine.com
• ctvnews.ca
• majalla.com
• forbes.com
• koreajoongangdaily.com
• legis1.com
• globalbankingandfinance.com
• egyptian-gazette.com
• outlookindia.com
• arabnews.pk
• aljazeera.com
• tbsnews.net
• cyberscoop.com
• bleepingcomputer.com
• biggo.com
• inc.com
• radio.cz
• internazionale.it
• theprint.in
• koreajoongangdaily.com
• koreajoongangdaily.com
• sbs.co.kr
• koreajoongangdaily.com
• unn.ua
• japantimes.co.jp
• understandingwar.org
• militarnyi.com
• understandingwar.org
• understandingwar.org
• heraldcorp.com
• heraldcorp.com
• sedaily.com