![\"picture](\"https:\/\/www.europesays.com\/korea\/wp-content\/uploads\/2026\/08\/picture-taken-february-15-2026-released-north.jpg\")
<\/p>\n<\/p>\n
This picture taken on February 15, 2026 and released by North Korea’s official Korean Central News Agency (KCNA) on February 16, 2026 shows North Korean leader Kim Jong Un delivering a speech at the inauguration ceremony of Saeppyol Street in Pyongyang.
\nKCNA VIA KNS\/AFP via Getty Images<\/p>\n
North Korea’s Foreign Ministry issued a formal counter-statement on Tuesday rejecting an unprecedented eleven-nation cybersecurity advisory as a “stereotyped political accusation,” and \u2014 in a significant escalation of its diplomatic posture \u2014 named and attacked the Multilateral Sanctions Monitoring Team (MSMT) by name, calling it a “ghost mechanism” with no legal standing and accusing Washington of systematically “militarizing cyberspace” through the world’s largest cyber force.<\/p>\n
The statement, carried by state news agency KCNA and attributed to a Foreign Ministry spokesperson, came four days after the United States and ten partner governments published a joint alert on July 31<\/a> accusing North Korean IT workers of using forged identities and artificial intelligence tools to infiltrate global hiring platforms and funnel earnings to Pyongyang’s nuclear weapons and ballistic missile programs. That advisory was the subject of TechTimes’ own detailed reporting on its technical mechanisms and legal implications for hiring managers.<\/p>\n That advisory covered what the eleven nations described as an evolving scheme in which North Korean operatives use real-time deepfake video and fabricated identity documents to defeat hiring checks at companies across the United States, Europe, and Asia \u2014 funneling the proceeds to Pyongyang’s weapons programs.<\/p>\n Pyongyang’s Rebuttal Targeted the Institution, Not Just the Claim<\/p>\n Most state-level denials of cybersecurity attributions are categorical and brief \u2014 a denial of involvement, a sovereignty objection, and nothing more. North Korea’s August 4 statement was structurally different in a way that matters. Rather than simply rejecting the content of the July 31 advisory, Pyongyang’s Foreign Ministry aimed its sharpest language at the MSMT itself \u2014 the body that produced the underlying intelligence reports and coordinated the advisory cycle.<\/p>\n The KCNA statement directly attacked<\/a> the MSMT’s credibility: “The repeated malicious assertion of the member states of the multilateral sanctions monitoring team merely aims to spread false information devoid of credibility.” The statement went further, describing the MSMT as a “ghost mechanism the West organized of its own accord” \u2014 language that deliberately frames the body not as a partisan watchdog but as an entity with no legitimate international standing.<\/p>\n This is the second time North Korea has used near-identical language specifically targeting the MSMT. When the body published its first report in May 2025 \u2014 covering North Korea’s military cooperation with Russia, including arms transfers \u2014 Pyongyang’s Foreign Ministry called it a phantom group<\/a> with “no legitimacy in terms of its existence and purpose” and described its activities as “a gross violation of the principles of international law.”<\/p>\n The pattern across both MSMT reports is deliberate: Pyongyang is not engaging with the content of either report on factual terms. It is running a persistent campaign to deny the MSMT the status of a credible international institution \u2014 which is a different and more consequential diplomatic objective than simply denying individual allegations.<\/p>\n Why “Ghost Mechanism” Is More Than Rhetoric<\/p>\n The “ghost mechanism” characterization has a factual kernel that makes it diplomatically effective beyond Pyongyang’s immediate audience. The MSMT is not a United Nations body. It has no Security Council mandate. It was established in October 2024<\/a> specifically because Russia exercised its veto in March 2024 to terminate the mandate of the UN Panel of Experts on North Korea \u2014 the body that had monitored DPRK sanctions compliance since 2009. The eleven participating states built the MSMT as a workaround: a voluntary coordination mechanism among like-minded governments that can produce reports and advisories but cannot compel any state to act, impose penalties, or claim UN Security Council authority.<\/p>\n North Korea’s description of it as self-organized by the West is, technically, accurate. The MSMT was not established by vote in the General Assembly, endorsed by the Security Council, or embedded in any binding international legal framework. That distinction does not make the MSMT’s findings wrong or its reporting less rigorous \u2014 but it does give states that are skeptical of Western-led sanctions architectures a basis for treating MSMT outputs as politically motivated rather than authoritative.<\/p>\n For companies and security teams, the practical implication is narrow: MSMT advisory content is corroborated by national intelligence services, domestic law enforcement agencies, and private security firms operating completely independently of the MSMT \u2014 including the FBI, CISA, CrowdStrike, Mandiant, and Palo Alto Networks. The North Korean IT worker threat documented in the July 31 advisory is real and independently verified regardless of how one characterizes the MSMT’s legal standing.<\/p>\n The Tu Quoque Argument: US Cyber Command as the Real Threat<\/p>\n The second structural element of Pyongyang’s statement is a classic tu quoque (“you too”) argument: the United States, not North Korea, is the world’s greatest cyber threat, precisely because the US built and operates the world’s largest cyber force and was the first nation to establish a dedicated Cyber Command.<\/p>\n The full statement from KCNA<\/a> read in part: “The U.S., which was the first in the world to form a cyber command, is hell-bent on joint cyber drills including the Cyber Flag with its allies. And it also formed a military-industrial complex for cyber warfare to steadily expand and strengthen its cyber attack force. The concept of cyber operation, which has been applied to every joint military drill frequently staged by the U.S. with its vassal forces, is by no means for ‘defense’ but part of its war preparations.”<\/p>\n The statement also took direct aim at US artificial intelligence policy, calling out what it described as Washington’s assertion that AI is “equivalent to nuclear weapons” \u2014 a reference to the framework increasingly used by senior US government and intelligence officials to characterize frontier AI models as national security assets requiring export controls, security review, and allied coordination equivalent to nuclear technology. In Pyongyang’s framing, this posture \u2014 rather than North Korea’s IT worker operations \u2014 is the source of “a new security crisis” in cyberspace.<\/p>\n Tu quoque arguments are logically invalid as denials: the fact that the US operates a large cyber force does not prove North Korea does not operate an IT worker infiltration scheme. But they are effective as diplomatic moves, and North Korea has deployed the same structure consistently across its major attribution disputes \u2014 denying Sony in 2014, denying WannaCry in 2017, and now denying the MSMT’s cyber and IT worker findings through an identical rhetorical pattern.<\/p>\n A Dual-Track Day in Pyongyang’s Media Operation<\/p>\n The cyber pushback was not issued in isolation. On the same day KCNA carried the Foreign Ministry statement, it also published a separate military editorial condemning the US-led RIMPAC naval exercise \u2014 the world’s largest international maritime warfare exercise, which ran from June 24 through July 31 near Hawaii \u2014 as a “war rehearsal of aggression<\/a>.”<\/p>\n