President Donald Trump’s recent decision to reduce US participation in joint military exercises with South Korea briefly revived chatter of diplomatic dialogue on the Korean Peninsula, coming only days after President Lee Jae Myung renewed his call for talks with Pyongyang. North Korea, however, was characteristically dismissive. Even if diplomacy is revived, the past several years have dramatically changed North Korea’s position.
It has spent those years continuing to develop its nuclear and missile capabilities despite sanctions, isolation and repeated diplomatic pressure. Becoming increasingly adept at working around those constraints, it has sustained access to foreign currency, trade and technology through its illicit networks. It now presents itself as an “irreversible” nuclear power. Constitutional revisions adopted over the past two years, culminating in changes made earlier in 2026, formally abandoned the longstanding goal of reunification and codified the two Koreas as separate states. Any future diplomacy would therefore have to deal with a relationship increasingly defined by coexistence rather than reunification.
Whilst diplomacy would be welcome, recent North Korean ballistic missile launches have done little to ease tensions around the peninsula. South Korea and Japan remain directly exposed to the threat, with both continuing to strengthen their military preparedness and cooperation in response. For Europe, the security of these partners is increasingly difficult to separate from its own, particularly as the EU deepens its security relationships across the Indo-Pacific.
Pyongyang is no longer only a threat to Europe’s regional partners in Asia. Its involvement in Russia’s war against Ukraine has made it a participant in a conflict on the European continent itself, supplying Russia with weapons and personnel while gaining experience from their use. Ukraine has become a frontline for military innovation, where new and existing systems are being rapidly combined and adapted under combat conditions. North Korean forces are gaining access to that process as both a supplier and a combatant, with lessons and capabilities that can be brought back to the Korean Peninsula.
Adapting to modern combat
One recovered munition shows how North Korean weapons are being repurposed on the battlefield. Ukrainian authorities later recovered a munition after a strike on Kherson, which Conflict Armament Research examined. It was a North Korean submunition, stamped with a Juche calendar date corresponding to the year 2000. Produced a quarter of a century ago for rocket artillery, it had been fixed to a drone with a wooden stick, wire and duct tape. The find, CAR concluded, established “yet another direct material link” between the North Korean defence industry and the war.
Crude as the improvisation looks, it marks one end of a substantial trade. Pyongyang supplies volume and manpower. The Multilateral Sanctions Monitoring Team, formed by 11 states after Russia’s 2024 veto ended UN sanctions oversight, documented as many as nine million rounds of artillery and rocket ammunition delivered in 2024 alone, along with at least 100 ballistic missiles later fired into Ukraine. For Ukraine, that support enables Russia to sustain the intensity of its offensive operations, particularly its heavy use of artillery.
The same report recorded transfers from Moscow to Pyongyang in late 2024 of short-range air defence systems, anti-aircraft missiles and electronic warfare equipment, alongside performance data on the missiles Pyongyang had supplied. That trade has also carried fuel, food and cash into a sanctioned economy. The Russian contribution may not amount to a wholesale transformation of North Korean weapons: recent analysis suggests the likeliest Russian contribution to the KN-23’s accuracy was to help defeat Ukrainian jamming of satellite navigation, rather than a redesign. However, the contribution also provides a much-needed economic lifeline to Pyongyang, easing some of the pressure created by years of International sanctions and isolation.
Recent analysis found Korean People’s Army units feeding reconnaissance drone information into artillery fire-control loops, compressing the sensor-to-shooter cycle from hours to minutes. The adaptation is becoming embedded beyond the equipment itself, in doctrine and fire-control procedures as well.
For a military with gaps in conventional capabilities, drones can provide a relatively cheap way to fill some of them, from reconnaissance and targeting to strike capacity, without having to reproduce the larger systems they complement.
These adaptations are also happening on the industrial side. The Multilateral Sanctions Monitoring Team now reports that North Korean workers are manufacturing military drones at the Alabuga Special Economic Zone in Tatarstan, a major assembly site for the Iranian-designed Shahed-136, produced locally as the Geran-2. The complex has since moved beyond the original Geran-2, with newer Geran-4 and Geran-5 variants now in serial production. Ukrainian Defence Intelligence estimates monthly production at roughly 2,800 Geran-2s and 3,000 Geran-4/5s. Their presence gives North Korean personnel direct exposure to the industrial process behind serial drone production. Whilst North Korea is still a long way from reproducing Russia’s military-industrial system at home, the question is how much it can absorb and move into production.
Bringing the lessons home
Much of what Pyongyang learns in Ukraine will not stay there. It is already building the capacity to put those lessons to use at home. At the Unmanned Aeronautical Technology Complex, Kim Jong Un called drone technology and artificial intelligence (AI) a “top-priority and important task”, and instructed officials to expand serial production. Imagery of Panghyon Airbase shows additional hangars completed and a test unit for strategic UAVs established. Some 3,000 experienced soldiers have returned home, most as military instructors, allowing experience of drone-enabled warfare and modern tactics to be institutionalised through training and exercises.
What it cannot learn in the field, it takes from European industry. ESET published research on a wave of Operation DreamJob, a cyberespionage campaign run by the North Korea-linked Lazarus Group using fake job offers to compromise targets. The wave targeted three European defence firms, all making equipment deployed in Ukraine, with at least two tied to drone supply chains.
That campaign has continued. Check Point reported a further wave exploiting a Windows zero-day to target aerospace firms in France and Germany, with a compromised French company used as a relay to reach additional targets. The concern extends beyond the theft of specific data: such campaigns can also give Pyongyang access to European defence technologies and supply chains.
The relationship with Russia may also be opening new avenues for North Korea’s cyber operations. Recent analysis has identified links between North Korean actors and Russian-speaking cybercriminal networks, potentially strengthening an already established capability.
Artificial intelligence is another vector helping North Korea scale its operations. For years, North Korean phishing campaigns were often identifiable from the language errors in their messages. Generative AI has removed some of that language barrier allowing its operators easier targeting of firms. AI is already acting as a force multiplier across Pyongyang’s revenue and infiltration operations, including through prompt injection used to defeat identity checks without relying on deepfakes.
But none of this began with Ukraine. Pyongyang was stealing industrial secrets and hard currency well before 2022, and artificial intelligence has accelerated a programme already running. It has also changed how that programme reaches Europe: North Korean IT workers are using generative tools to mass-produce CVs and cover letters, fabricate profile images and run deepfake video and audio through remote interviews, with synthetic profiles used to register on European employment platforms. Google’s threat intelligence team has documented North Korean actors using AI across reconnaissance, target research, vulnerability research, scripting, payload development and evasion. It makes reconnaissance faster, social engineering more convincing and technical experimentation cheaper, giving a relatively small cyber apparatus more room to operate at scale.
Those same tools are now being brought in-house. The South Korean firm Genians reported finding Kimsuky, a North Korean cyberespionage group linked to the country’s Reconnaissance General Bureau, running open-source language models in local environments, rather than relying entirely on external AI services. Running models locally also reduces the amount of activity visible to external AI providers, making it harder for them to monitor or disrupt. The significance of these developments extends beyond cyberspace, as strengthening these capabilities can enhance North Korea’s wider efforts to generate revenue and acquire technology.
A threat beyond the war
North Korea will undoubtedly leave their participation in the Ukraine war in a stronger position than it entered it. Its nuclear deterrent is now backed by greater conventional experience and a more capable defence industry, while its military relationship with Russia has expanded beyond ammunition transfers. The longer the war continues, the more deeply North Korea can become embedded in Russia’s military effort, giving it further opportunities to develop its own capacities through the conflict. Its growing contribution also provides Moscow with another source of support for a war that directly affects European security, extending the concern for the EU beyond the Korean Peninsula.
Cyber activity with an international reach will remain a growing threat to European interests, regardless of what happens to the Russia relationship. North Korean operators are already targeting European defence companies, while cryptocurrency theft and AI-assisted operations are opening further avenues for revenue generation and technology acquisition. The relationship with Russia may accelerate that development by exposing North Korean operators to a wider cyber environment in which to operate. This makes continued investment in cyber defence and closer cooperation with South Korea, Japan and other partners increasingly important.
The consequences of a stronger North Korea could also emerge through the arms trade. Whether through a peace settlement or a change in the course of the war, Russian demand for North Korean weapons and personnel could rise or fall from its current level. A reduction in Russian demand could leave Pyongyang looking for other markets for its expanding arms industry. Having previously supplied or sought to supply weapons and military technology to countries in the Middle East and Africa, North Korea could again look to diversify its exports. Such a shift could compound instability in future conflicts or strengthen armed groups, with consequences for the EU, notably through maritime disruption around the Red Sea and wider migration pressures.
The absence of a UN-led monitoring mechanism, following Russia’s veto of its renewal, has made it harder to build a complete picture of North Korea’s sanctions evasion, while maritime transfers, illicit finance and cyber operations increasingly overlap. Those networks are adapting, and AI is making parts of them faster, cheaper and more difficult to detect. Europe therefore needs to continue deepening its relationships with regional partners to improve the intelligence and monitoring that underpin sanctions enforcement and proliferation controls. This is particularly important as North Korea becomes better at adapting around the restrictions imposed on it.
South Korea already contributes to that effort through the Multilateral Sanctions Monitoring Team, but the EU–South Korea security relationship can go further. The 2024 Security and Defence Partnership already enhances defence industry cooperation between the two partners, by covering cyber threats, non-proliferation, space security and exchanges on defence-industry matters. Speeding up the negotiations of a Security of Information Agreement, would provide a dedicated framework for exchanging and protecting classified information. That could make sanctions monitoring more robust when the underlying evidence cannot be made public, while supporting deeper technical cooperation where sensitive information is involved. The value of that framework is likely to grow in areas such as secure satellite connectivity, where the two sides are already examining system-level cooperation with IRIS², and in future counter-drone cooperation.
The Digital Partnership between the EU and South Korea is more relevant on the industrial side, where North Korean activity increasingly targets companies, researchers and technology supply chains. It already brings European and South Korean actors together through cybersecurity cooperation, joint semiconductor projects and work on digital skills. Those channels could support sector-focused workshops and skills programmes on AI-enabled social engineering and North Korean IT-worker infiltration. Existing semiconductor supply-chain exchanges could also be widened to cover technology-leakage risks around sensitive research and production. These practical steps would strengthen the response to North Korea’s immediate risks without depending on progress in diplomacy.
Whilst diplomacy should always be pursued, any renewed negotiations will take place with North Korea in a far stronger position than before the war. Europe therefore needs to be prepared for both the continuation of North Korea’s involvement in Russia’s war and the possibility that its eventual end pushes Pyongyang towards new ways of using and financing the capabilities it has accumulated.
Author: Thomas Nielsen, EIAS Junior Researcher
Photo credits: unsplash