North Korea Security Report — February 25, 2026

Security analysis based on open-source intelligence and web research. Period: February 18 — February 25, 2026.

Security Analysis Report: North Korea (February 18, 2026 - February 25, 2026)

Executive Summary

During the period of February 18-25, 2026, North Korea demonstrated a continued commitment to enhancing its military capabilities and deepening strategic alliances, while simultaneously escalating its cyber warfare activities. The nation unveiled 50 new 600mm multiple launch rocket systems (MLRS) on February 18, signaling advancements in its nuclear-capable short-range missile arsenal. The 9th Workers' Party Congress, which commenced on February 19, saw Kim Jong Un re-elected as General Secretary, with strong congratulatory messages from China and Russia underscoring a strengthening trilateral alignment against Western pressure. Concurrently, North Korean state-sponsored cyber groups, notably Lazarus and Kimsuky, intensified their malicious campaigns, employing Medusa ransomware against healthcare organizations and sophisticated spearphishing tactics to target various entities globally. These developments collectively indicate Pyongyang's resolve to bolster its defense posture, secure economic resources through illicit cyber means, and solidify its geopolitical standing amidst ongoing international isolation.

Key Security Developments

• Military Activities and Exercises
  On February 18, 2026, North Korea held a ceremony to unveil the deployment of 50 new launch vehicles for its 600mm multiple launch rocket systems (MLRS) in Pyongyang. These systems are considered nuclear-capable short-range missiles designed to overwhelm missile defenses in South Korea. This deployment highlights North Korea's ongoing efforts to diversify and expand its strike options.
  Preparations for a large-scale military parade were also observed, possibly to mark Army Day on February 8 or in connection with the ongoing Ninth Party Congress of the Workers' Party of Korea. Thousands of people were reportedly mobilized for rehearsals.
  Approximately 8,000 North Korean troops remain deployed in Russia's Kursk Oblast, where they have been performing fire support functions under Russian command in the war against Ukraine. This deployment provides Pyongyang with valuable military experience and strengthens its alliance with Moscow.

• Defense Policy and Strategic Shifts
  The Ninth Congress of the Workers' Party of Korea (WPK) opened on February 19, 2026, in Pyongyang, where leader Kim Jong Un was re-elected as the top party post on February 22. This congress is a crucial event where Kim is expected to outline domestic and foreign policies for the next five years, including plans to further expand the capabilities of his nuclear-armed military and integrate conventional weapons systems with nuclear forces.
  North Korea has reiterated its focus on a dual policy of nuclear and conventional military development, emphasizing the importance of enhancing nuclear deterrence. This strategy aims to provide nuclear second-strike capabilities against the U.S. mainland and conventional saturation strikes against South Korea.
  North Korea issued a threat of retaliation against South Korea following accusations of surveillance drone flights in September and January. In response, South Korea is reportedly considering reinstating a suspended 2018 inter-Korean military pact aimed at reducing border tensions.

• Diplomatic Relations
  Russia and China sent congratulatory messages to the Ninth Congress of the Workers' Party of Korea on February 20, 2026. Dmitri Medvedev, chairman of the United Russia Party, highlighted the "strategic partnership" between Russia and North Korea, based on a long tradition of friendship and cooperation, emphasizing their joint efforts in repelling external pressure and ensuring stability in the Asia-Pacific region. This relationship is seen as a de facto military alliance, with North Korea actively participating in Russia's war in Ukraine.
  Chinese President Xi Jinping congratulated Kim Jong Un on his re-election on February 23, 2026, reaffirming China's "unwavering policy" to maintain and solidly advance bilateral ties and proposing to "open a new chapter" in China-North Korea friendship. Xi described China and North Korea as "friendly socialist neighbors."
  Japanese Prime Minister Fumio Kishida expressed his intent to hold a summit with Kim Jong Un to resolve the long-standing issue of Japanese citizens abducted by North Korea. Kim Yo Jong, Kim Jong Un's sister, also voiced a positive outlook on future North Korea-Japan relations, hinting at a potential historic meeting. However, North Korea had previously reaffirmed its refusal to communicate with Japan on this matter.
  While US-North Korea relations remained largely static in 2025, there is a "flickering ember of hope" for renewed talks in 2026, particularly with US President Donald Trump's expressed willingness to meet Kim Jong Un. However, Kim Jong Un has consistently stated that denuclearization is no longer on the table and that talks could only proceed if the U.S. recognizes North Korea as a nuclear state.

• Security Incidents and Threats
  North Korea threatened retaliation against South Korea for alleged drone incursions in September and January, indicating heightened tensions along the border.

• Defense Acquisitions and Arms Deals
  Kim Jong Un ordered officials to step up production of missiles and construct more munitions factories for 2026 to meet the military's growing needs and strengthen the nation's "war deterrent." This follows recent inspections of munitions enterprises and approval of modernization plans.
  North Korea is expected to seek advanced military technologies from Russia, including nuclear-powered submarine capabilities and fighter jets, to address weaknesses in its air force.

• Cybersecurity
  North Korea's state-sponsored Lazarus Group has adopted Medusa ransomware for extortion attacks, targeting at least one US healthcare organization and an unnamed victim in the Middle East as of February 24, 2026. This marks a new tool in their arsenal.
  The Lazarus Group continues to employ spear phishing attacks, often disguised as "lecture invitations or interview requests," to steal funds from critical sectors including cryptocurrency, finance, IT, and defense.
  The Kimsuky group is leveraging malicious QR codes in spearphishing campaigns to target US entities, including NGOs, think tanks, academia, and foreign policy experts.
  North Korean nation-state threat actors are actively engaged in the "Contagious Interview" campaign, posing as recruiters to trick software developers into executing malicious code projects. This campaign aims to steal credentials and gain remote control of devices, impacting thousands of developers.
  GitLab's Threat Intelligence Team revealed and disrupted operations related to North Korean tradecraft, including the creation of synthetic identities and large-scale service abuse. An individual North Korean operator was found to have maintained a target list of over 1,000 individuals, with 88 having executed malicious projects.

• Intelligence Activities
  North Korean IT workers are operating from various locations, including Russia, using stolen or shared identities to engage in contract software development and malware distribution, generating revenue for the regime. These activities involve creating synthetic identities and abusing legitimate platforms.

Geopolitical Impact and Regional Dynamics

North Korea's recent security developments, particularly its military modernization and deepening alliances, significantly impact regional stability and relations with major powers. The public display of new 600mm MLRS and the commitment to increased missile production underscore Pyongyang's determination to advance its nuclear and conventional strike capabilities, directly challenging the security of South Korea, Japan, and the United States. This aggressive posture, coupled with threats of retaliation for alleged drone incursions, exacerbates tensions on the Korean Peninsula and necessitates a robust deterrence strategy from the US-ROK alliance.

The strengthening strategic partnerships with Russia and China are a critical factor in North Korea's emboldened stance. Congratulatory messages from Moscow and Beijing to Kim Jong Un's re-election at the WPK Congress highlight a growing alignment, with Russia explicitly acknowledging a "strategic partnership" and China reaffirming an "unwavering policy" to advance ties. This trilateral cooperation provides North Korea with crucial political backing, economic lifelines, and potential military-technical assistance, particularly from Russia, which is reportedly enabling North Korea's nuclear-powered submarine development. This dynamic complicates international efforts to enforce sanctions and pressure Pyongyang, as it offers a "bulwark for building sanctions resilience."

While diplomatic overtures from Japan and the US are being discussed, North Korea's firm stance on denuclearization as a precondition for talks remains a significant hurdle. Pyongyang's increasing adversarial approach towards South Korea, including potential moves to redefine maritime boundaries, further complicates inter-Korean relations and regional stability. The ongoing cyberattacks by North Korean state-sponsored groups, targeting critical infrastructure and financial institutions globally, also pose a significant threat to international cybersecurity and serve as a means for the regime to generate illicit revenue.

Military and Defense Analysis

North Korea's military posture is characterized by a relentless pursuit of advanced weaponry and a clear strategy to enhance its nuclear deterrence. The unveiling of 50 new 600mm multiple launch rocket systems on February 18, 2026, demonstrates a significant upgrade in its short-range missile capabilities. These systems, capable of carrying nuclear warheads, are designed to saturate and overcome existing missile defenses in the region. The directive from Kim Jong Un to increase missile production and construct new munitions factories for 2026 further underscores the priority placed on expanding its arsenal and strengthening its "war deterrent."

Modernization programs are a central theme, with plans to be unveiled at the 9th Workers' Party Congress focusing on a "dual policy" of developing both nuclear and conventional forces. This includes an extensive wish list of sophisticated assets such as solid-fuel intercontinental ballistic missiles, multi-warhead systems, tactical nuclear weapons, spy satellites, and nuclear-powered submarines. The reported tour of a nuclear submarine factory and research into "new underwater secret weapons" indicate a strong drive to develop a nuclear-powered submarine capability, potentially with Russian technical assistance, to significantly expand its maritime deterrence. The deployment of approximately 8,000 North Korean troops to Russia's Kursk Oblast not only provides military support to Russia but also offers North Korean forces invaluable combat experience, contributing to their overall capability development.

Outlook and Forecast

Short-term trends (1-3 months): In the immediate future, North Korea is highly likely to continue its aggressive military modernization, with the 9th Workers' Party Congress serving as a platform to formally announce new defense policies and five-year development plans. We can anticipate further displays of military strength, potentially including additional missile tests or military parades, to solidify Kim Jong Un's leadership and demonstrate progress on stated goals. Cybersecurity threats from North Korean state-sponsored groups will remain high, with continued focus on financial theft and espionage against critical sectors globally. Diplomatic rhetoric towards South Korea is expected to remain hostile, while engagement with China and Russia will deepen, possibly leading to more concrete agreements on economic and military cooperation.

Critical flashpoints and risk areas: A critical flashpoint remains the Korean Peninsula's maritime boundaries, with North Korea potentially codifying laws to redefine the Northern Limit Line, which could lead to naval confrontations. Any further alleged drone incursions or military exercises by South Korea and the US could provoke a strong, potentially disproportionate, response from Pyongyang. The ongoing cyber campaigns, particularly those targeting healthcare and financial institutions, pose a significant risk of disruption and financial loss for international entities. The potential for Russia to provide advanced military technology to North Korea, especially related to nuclear-powered submarines or fighter jets, could significantly alter the regional power balance and escalate tensions with the US and its allies.

Indicators to monitor: Key indicators to monitor include the specific policy pronouncements and strategic goals outlined during the ongoing 9th Workers' Party Congress. Any new details regarding military-technical cooperation between North Korea and Russia, particularly concerning technology transfers, will be crucial. The frequency and nature of North Korean missile tests, especially those involving new systems or capabilities, will provide insight into their modernization progress. Furthermore, any shifts in the diplomatic postures of the United States and Japan towards engagement with Pyongyang, and North Korea's response to such overtures, will be important to observe. Finally, continued monitoring of North Korean cyber activity, including new malware variants or targeting patterns, is essential to anticipate and mitigate future threats.

Strategic recommendations: To counter North Korea's evolving security posture, a multi-faceted approach is recommended. Firstly, maintaining a robust and credible deterrence posture through combined military exercises with South Korea and Japan is essential to discourage provocations. Secondly, enhancing international cooperation on cybersecurity is critical to defend against North Korea's sophisticated cyberattacks and disrupt its illicit revenue generation. This includes intelligence sharing and coordinated defensive measures. Thirdly, while maintaining firm pressure on denuclearization, exploring pragmatic avenues for dialogue with North Korea, potentially through multilateral frameworks involving China and Russia, could be considered to manage tensions and prevent miscalculation, even if denuclearization remains a long-term goal. Lastly, closely monitoring the Russia-North Korea strategic partnership for any signs of advanced military technology transfers or increased military coordination is paramount to understanding and mitigating future threats.

Sources

• alarabiya.net
• chosun.com
• joins.com
• nampa.org
• theregister.com
• gitlab.com
• fbi.gov
• markets.com
• hrw.org
• understandingwar.org
• military.com
• news1.kr
• apa.az
• wikipedia.org
• 38north.org
• chathamhouse.org
• straitstimes.com
• sadanews.ps
• thepeninsulaqatar.com
• cp24.com
• rbc.ua
• thehackernews.com
• eastasiaforum.org
• dailynk.com
• japantimes.co.jp