Misconfigured cloud server leaked clues of North Korean animation scam

A misconfigured cloud server tied to a North Korean IP exposed daily animation work artifacts that investigators from Stimson Center/38 North and Mandiant assessed as evidence of covert outsourcing to DPRK animators, likely linked to the sanctioned April 26 Animation Studio (SEK). Access logs showed predominant VPN use, with some logins from China and Spain, and files tied to projects from major studios (e.g., Amazon’s Invincible, HBO Max/Cartoon Network’s Iyanu, and BBC’s Octonauts), though there’s no indication the studios knew of the subcontracting. The findings suggest broader DPRK revenue-generation via disguised IT/creative work using relay servers, aligning with past advisories on North Korean illicit outsourcing practices.