Reconnaissance General Bureau
The established U.S. and UN sanctions name. It remains the searchable identity in current OFAC records.
Analysis · Intelligence dossier 001Last reviewed August 1, 2026
RGB → GRIB
North Korea’s global operations bureau.
A living, source-led record of the organization behind espionage, special operations, cyberattacks, illicit finance, and covert activity against the United States, South Korea, Japan, and targets worldwide.
Established2009
Renamed2025
Primary focusU.S. · ROK · Japan
Name & lineage
One bureau. A changing public identity.
The public record now uses overlapping names. This report keeps each one visible so readers—and FOIA searches—do not lose the organizational trail.
General Reconnaissance Information Bureau
The English name used by KCNA when North Korea publicly revealed the reorganized bureau.
General Reconnaissance and Intelligence Bureau
A later English translation used in North Korean accounts of military parades. Both variants belong in searches.
Editorial note: the 2025 Korean announcement is evidence of a reorganization and new name, not evidence that older U.S. records were retitled. Search both RGB and GRIB, including both English expansions of GRIB.
Operational geography
The conflict extends far beyond the DMZ.
North Korean operations connect physical infiltration and intelligence collection on the peninsula with cyber access, revenue generation, and targeting worldwide.
Inside the United States
Sony Pictures, hospital ransomware, theft of American identities, remote-worker impersonation, cryptocurrency cases, and targeting of defense, energy, aerospace, technology, State, and Defense personnel.
U.S. forces and people abroad
Operations directed at two U.S. Air Force bases, NASA-OIG, defense contractors, military technology, diplomats, and overseas networks used to fund or conceal activity.
South Korea and Japan
Infiltration, covert networks, assassinations and abductions, DarkSeoul, military-plan theft, attacks near the DMZ, and collection against the U.S.–ROK–Japan alliance.
Global revenue and access
Bank theft, cryptocurrency heists, ransomware, arms networks, front companies, forged employment identities, and representatives operating across Asia, Europe, and Russia.
Cyber constellation
Different names. Connected missions.
Government and private-sector labels do not always describe a clean command chart. These cards use U.S. government attribution language and preserve the aliases most likely to appear in sanctions, court, and technical records.
Lazarus Group
The umbrella name most closely associated with destructive attacks and major cryptocurrency theft. U.S. cases connect RGB personnel to Sony, WannaCry, financial theft, and malicious crypto applications.
Bluenoroff
A financially focused cluster tied by Treasury to the RGB structure and to high-value bank and virtual-currency theft.
Andariel
An espionage and revenue operation linked to hospital ransomware, defense theft, two U.S. Air Force bases, NASA-OIG, and fraudulent remote-worker activity.
Technical Reconnaissance Bureau
An RGB-controlled bureau designated by OFAC in 2023. It develops offensive cyber tactics and tools; its subordinate 110th Research Center has operated in the United States and South Korea.
Working chronology
From merger to remote-worker infiltration.
North Korea consolidates major clandestine and military reconnaissance bodies into the RGB.
The United States lists the RGB under Executive Order 13551; the UN later designates it in 2016.
The FBI reports no responsive main-file records to DMZ War requests on North Korean intelligence and terrorist operations; an administrative appeal is denied.
Sony, Bangladesh Bank, WannaCry, and related cases turn RGB cyber activity into a major U.S. law-enforcement and sanctions record.
DMZ War files request 1391835-000 on RGB operations in the United States and against U.S. persons, organizations, and facilities; the FBI again reports no responsive main files.
OFAC designates Lazarus Group, Bluenoroff, and Andariel as North Korean state-sponsored cyber groups subordinate to the RGB.
OFAC designates the Technical Reconnaissance Bureau and 110th Research Center; DOJ charges an Andariel actor in attacks on U.S. hospitals, bases, and NASA-OIG.
North Korean state media reveals the reorganized GRIB name; Treasury sanctions an Andariel-linked actor involved in impersonating Americans for remote work.
Treasury describes DPRK IT-worker networks using stolen identities, fabricated personas, malware, and extortion against U.S. businesses.
DMZ War records project
The files the government says it cannot find.
PSB reports preserve the earlier FBI requests, denials, appeal, and follow-up. Those records now serve as the baseline for narrower, case-led requests to the FBI and Treasury’s Office of Foreign Assets Control.
Released record
FBI search and appeal
The FBI said a Central Records System search found no responsive main-file records for the Reconnaissance Bureau. DOJ’s Office of Information Policy affirmed the search after reviewing sixteen related requests.
Released record
RGB operations in America
Request 1391835-000 sought records on operations within the United States or against U.S. persons, organizations, and facilities. A March 2018 response supplied aliases, units, officials, sanctions terms, and case leads for an additional search.
Active request
Renewed FBI release effort
The new request is being shaped around later public indictments, named RGB actors, U.S. victims, overseas bases, cyber aliases, and specific FBI investigations that post-date the older no-record responses.
Active request
Treasury / OFAC RGB files
The request seeks final designation records, organizational and alias histories, source inventories, public-facing evidentiary material, interagency referrals, and releasable analysis linking RGB targets and operations.
PSB archival anchorRGB-FBI-Lawsuit / Recon Bureau
Includes request 1391835-000, the March 8, 2018 additional-search letter, 2012 request and appeal records, FBI no-main-file responses, and related intelligence leads.
Official government finding
Separate individual listings from parent-group ties.
The OFAC–FBI evidence desk renders the verified Treasury timeline, eight individually listed people, and the four-person FBI overlap table. It preserves the controlling distinction: Park Jin Hyok is individually listed; Jon Chang Hyok, Kim Il, and Rim Jong Hyok were found with listed parent affiliations but without separate public individual entries in the reviewed record.
Open the evidence desk →Primary-source desk
Follow the evidence.
Official releases are linked directly. Allegations in indictments remain allegations; organizational labels may overlap or change as governments update their assessments.
01KCNA archive: first public use of the reorganized name↗02Treasury: Technical Reconnaissance Bureau and illicit IT workers↗03Treasury: Sony, Bangladesh Bank, and WannaCry↗04Treasury: Lazarus, Bluenoroff, and Andariel↗05Treasury: Andariel-linked U.S. remote-worker impersonation↗06Treasury: 2026 IT-worker fraud targeting U.S. businesses↗07Justice: three RGB military hackers and worldwide cases↗08Justice: hospitals, U.S. Air Force bases, NASA-OIG, and Andariel↗