Cyber Threat Actor: Reconnaissance General Bureau

The Reconnaissance General Bureau,also known by its acronym RGB, is the military intelligence agency of the Democratic People’s Republic of Korea. Publicly available sources identify the organization as a state‑run entity operating under the North Korean government, and it is frequently referenced in connection with the country’s strategic cyber activities. The bureau’s primary role is to gather intelligence and support the nation’s defense and foreign policy objectives through covert means, including cyber operations. Its affiliation with the North Korean state establishes a clear government nexus, distinguishing it from purely criminal or financially motivated threat actors. The alias “RGB” appears in various open‑source reports that attribute specific cyber incidents to this organization, reinforcing its recognition within the cybersecurity community as a North Korean state‑sponsored actor.

In September 2017, a U.S. presidential directive authorized a coordinated, government‑wide pressure campaign against North Korea that incorporated military cyber operations as a central component. As part of this effort, United States Cyber Command executed a disruptive action against the Reconnaissance General Bureau by overwhelming the agency’s computer servers with a high volume of traffic. This traffic flood effectively severed internet access for the bureau’s personnel, impairing their ability to conduct online operations. The maneuver exemplified a denial‑of‑service technique aimed at degrading the adversary’s cyber capabilities rather than extracting data or achieving financial gain. Officials described the action as one element of a broader, multi‑agency strategy intended to constrain North Korea’s ability to conduct malicious cyber activities. The incident remains a publicly cited example of direct state‑to‑state cyber confrontation involving the Reconnaissance General Bureau.