Washington-based North Korea watchdog group 38 North published a report on Monday suggesting that North Korean animators may have been hired by Western firms to work on their projects in defiance of international sanctions.
One of the projects mentioned by the report was the popular Amazon Prime superhero series Invincible.
The report was based on files procured by 38 North and cybersecurity firm Mandiant from a North Korean cloud server late last year. The server, discovered by a Boston-area amateur sleuth named Nick Roy, was seemingly abandoned but still accessible. Its security software was not properly configured, allowing anyone to view its contents without a password.
Ironically, North Korea uses such cloud servers because it wants to maintain tight control over its captive population’s access to the Internet. North Korean workers, even those in the tech industry, cannot directly access the worldwide Internet from the little electronic backwater maintained by their paranoid rulers. Instead, they have to move data in and out of a few cloud servers, whose contents are controlled by political overseers.
This particular cloud server was allegedly left wide open to observers from the outside world, so 38 North and Mandiant spent some time watching the data that flowed through it. Much of what they saw pertained to animators receiving instructions, such as notes about changing the appearance of animated characters, in Chinese text from outside production companies.
The identity of the North Korean animation firm could not be firmly established from the data on the cloud server, but 38 North suspected it was a studio known as April 26 Animation or SEK, the “premier animation house” in North Korea. The studio produces most of North Korea’s domestic cartoons, which are stuffed with government propaganda, and did some outside work with South Korean studios before sanctions made such arrangements impossible.
SEK was placed under sanctions by the U.S. Treasury Department in 2016 as a state-owned enterprise (SOE) under the control of the North Korean government. The Treasury department has subsequently sanctioned Chinese companies that continued to do business with SEK through front companies because the North Korean company provides “low-cost labor.”
Mandiant and 38 North reviewed server logs that suggested Chinese firms are still buying animation work from SEK at cut-rate prices – and some of those Chinese companies have, in turn, been subcontracted by American, British, and Japanese studios.
The most well-known of these projects is Amazon Prime’s Invincible, which just finished airing its second season. The files on the North Korean cloud server appeared to be work on the third season and included frames that clearly showed the main character. Researchers also found documents on the server that clearly referenced units of the production company.
Another project with work on the server was Iyanu, Child of Wonder, an animated fantasy adventure series that is scheduled to air later this year on Max, formerly known as HBO Max.
“There is no evidence to suggest that the companies identified in the images had any knowledge that a part of their project had been subcontracted to North Korean animators,” 38 North noted. “In fact, as the editing comments on all the files, including those related to US-based animations, were written in Chinese, it is likely that the contracting arrangement was several steps downstream from the major producers.”
Ironically, an episode from the second season of Invincible made fun of the shortcuts animation companies must take in order to deliver shows on tight schedules and budgets:
The 38 North report recommended more “due diligence” on outsourcing to avoid sanctions-busting schemes. The report cited a 2022 warning from the U.S. government that North Korean information-technology workers are adept at masquerading as residents of other countries and using virtual private network (VPN) technology to conceal their true location. The North Koreans have also been known to simply bribe people in the U.S. to host network connections for them so they can connect with American companies.
Mandiant researcher Michael Barnhart confirmed to Reuters on Monday that the producers of projects like Invincible and Iyanu probably had no idea they were receiving work from North Korean animators. He expressed “high confidence” that Chinese firms outsourced the animation in question to North Korea.
Barnhart pointed out that, in addition to running afoul of sanctions, any company that unwittingly employs North Korean workers could make itself a target for North Korean hackers, who are increasingly linked to all of Pyongyang’s state-owned enterprises.
A North Korean defector named Choi Seong-guk told Reuters that SEK had a unit dedicated to working with foreign studios when he worked there in the late 1990s. He and many of his coworkers quit their jobs over shockingly low pay (even by North Korean standards) to find better-paying work in China.
Skybound, the company behind Invincible, said it was unaware of any North Korean involvement in the show but “took the allegations seriously” and has launched a “thorough internal review,” in addition to contacting “the proper authorities.”
“Our policies strictly prohibit any subcontracting to any third-party without our express prior written consent, which, in this case, was neither sought nor granted,” the company said in a social media post to its fans. “We also mandate that all our service providers fully comply with all applicable rules and regulations and prohibit disclosures of materials by our service providers to third parties.”
Skybound obliquely referred to the 38 North/Mandiant report as “unconfirmed” in its post.
A source “familiar with the matter” told CNN on Tuesday that Lion Forge Entertainment, producers of the Iyanu show, hired a South Korean company to complete some of the animation, but severed ties when it discovered the South Korean studio was outsourcing work to other companies without proper authorization. The South Korean studio specifically denied sending work to North Korea.