A shadowy group trying to overthrow Kim Jong Un allegedly raided a North Korean embassy in broad daylight




A Spanish national police car is seen outside the North Korean Embassy in Madrid on Feb. 28. (Sergio Perez/Reuters)
By John HudsonMarch 15 at 12:39 PM

Days before President Trump was set to meet North Korean leader Kim Jong Un in Vietnam, a mysterious incident in Spain threatened to derail the entire high-stakes nuclear summit.

In broad daylight, masked assailants infiltrated North Korea’s embassy in Madrid, tied up the staff, stole computers and mobile phones, and fled the scene in two luxury vehicles.

The group behind the late February operation is known as Cheollima Civil Defense, a secretive dissident organization committed to overthrowing the Kim dynasty, people familiar with the planning and execution of the mission told The Washington Post.

The group’s alleged role in the attack has not previously been reported, and officials from the governments of North Korea, the United States and Spain declined to comment on it.

But in recent days, rumors about the motivations behind the attack have swirled in the Spanish media, including a report in El Pais alleging that two of the masked assailants have ties to the CIA.

People familiar with the incident say the group did not act in coordination with any governments. U.S. intelligence agencies would have been especially reluctant to be involved, given the sensitive timing and brazen nature of the mission. But the raid represents the most ambitious operation to date for an obscure organization that seeks to undermine the North Korean regime and encourage mass defections, they say.
On Feb. 28, President Trump and North Korean leader Kim Jong Un ended their Hanoi summit, aimed at negotiating North Korea's denuclearization, without a deal. (Jason Aldag/The Washington Post)

“This group is the first known resistance movement against North Korea, which makes its activities very newsworthy,” said Sung-Yoon Lee, a North Korea expert at Tufts University.

The identity of the assailants is a particularly sensitive topic, given the delicate nature of the relationship between Trump and Kim.

Trump, who began his presidency by threatening the annihilation of Kim and his country, has shifted to effusive praise for the young leader as he tries to persuade him to give up his nuclear program. But in the aftermath of the two leaders’ failed summit in Hanoi last month, tensions have reemerged, with North Korea’s vice foreign minister threatening Friday to suspend the denuclearization talks.


Any hint of U.S. involvement in an assault on a diplomatic compound could have derailed the talks, a prospect of which the CIA would likely be mindful. “Infiltrating a North Korean embassy days before the nuclear summit would throw that all into jeopardy,” said Sue Mi Terry, a former Korea analyst at the CIA. “This is not something the CIA would undertake.”

The agency declined to comment.

According to Spanish media reports, the assailants tied up the embassy staff with rope, put hoods over their heads and asked them questions. They spoke in Korean and appeared to be Asian.

More than an hour into the raid, a woman reportedly escaped, and her screams for help alerted a neighbor, who contacted police. When authorities arrived at the embassy, a man opened the door and told them there was no problem. Moments later, the embassy gates opened, and the assailants dashed out to two embassy cars and sped away, according to local reports. The vehicles were found abandoned on a nearby street.


Though the incident has attracted a flurry of Spanish media attention, no police reports were filed by the embassy or the victims, according to the reports.
Experts say the computers and phones seized in the raid contain a treasure trove of information that foreign intelligence agencies are likely to seek out from the group.

“It could have contacts and documents related to North Korea’s efforts to bypass sanctions and import luxury goods from Europe, which was one of the key assignments for Kim Hyok Chol, the former North Korean ambassador to Spain,” Lee said.

Recently, Kim Hyok Chol was reassigned as North Korea’s point man for the nuclear negotiations with the United States, making any information about his previous activities especially coveted by foreign governments looking to gain an edge in the negotiations.


The assailants also possess a video recording they took during the raid, which they could release anytime, said one person who, like others, spoke on the condition of anonymity to discuss a sensitive and illegal operation.

The Cheollima group, which also goes by the name Free Joseon, drew attention in 2017 after it successfully evacuated the nephew of Kim Jong Un from Macau when potential threats to his life surfaced. The nephew was the son of Kim Jong Nam, the North Korean leader’s exiled half brother who was assassinated in a nerve-gas attack in a Malaysian airport that same year. Kim Jong Nam was widely believed to have been killed by the regime, making his son a likely target.

Members of the Cheollima group transported Kim Han Sol out of Macau with the help of the governments of the United States, China and the Netherlands, which provided travel and visa assistance, the group told the Wall Street Journal in 2017.


For safety reasons, the leader of the group does not disclose his name, and his identity is known only to a small group of people.

In March, the group published a manifesto calling on North Koreans inside and outside the country to resist Pyongyang in ways big and small.

“To those within the system who hear this declaration: We call on you to defy your oppressors. Challenge them openly or resist them quietly,” the declaration said. “To those of like-mind and like-spirit of our diaspora: We call upon you to join our revolution.”

Since the attack on the embassy in Spain, the group has asserted responsibility for the defacingof the North Korean Embassy in Malaysia’s capital, Kuala Lumpur, on Monday. Authorities said four men who wore hats and masks painted the graffiti. The group has not claimed responsibility for the raid in Madrid.

“In its messaging, the group said they have formed a provisional government to replace the regime in Pyongyang,” said Terry, who is a scholar at the Center for Strategic and International Studies in Washington. “They have now shown the seriousness of their intent and some capabilities to carry out operations. We will see in the coming months the extent of their capabilities.”

Shane Harris contributed to this report.