Is Kim Jong-un on World of Tanks? The internet habits of North Korea's elite revealed

North Korea may be isolated on the global stage, but when it comes to the internet members of its ruling elite are surfing the web just like the rest of us: browsing social media, shopping on Amazon, checking emails, downloading torrents and listening to music on iTunes.

That's according to new research released this week by security firm Recorded Future, in collaboration with its intelligence partner Team Cymru. It concluded that the internet activity of the few who have access to the worldwide internet is "not that different from most Westerners".

The project analysed the North Korean internet landscape from 1 April to 6 July this year, a period chosen because it aligned with a significant spike in missile launching and testing.

University students, scientists and government officials in the country can access to a state-run intranet portal with basic features, known as 'Kwangmyong'.

There is also a growing amount of mobile phone use by the population, sometimes with smuggled handsets.

Millions of smartphones have been legitimately sold in the country but users are limited to a heavily controlled 3G network known as 'Koryolink'.

But senior leaders and the ruling elite in the regime – trusted family members of the Kim dynasty – are often granted access to the wider digital world.

Recorded Future found the "limited number of North Korean leaders and ruling elite with access to the internet are much more active and engaged in the world [...] than many outside North Korea had previously thought". As such, they are attuned to both pop culture and world events.

"[The] ruling elite are plugged into modern internet society and are likely aware of the impact that their decisions regarding missile tests, suppression of their population, criminal activities, and more have on the international community," the research paper stated.

Like everyone, the team said the rulers check social media accounts, search the web, browse Amazon, stream videos, use iTunes and download content via BitTorrent. They also game, with the data showing massively multiplayer online (MMO) title World of Tanks is popular.

Facebook is the most widely-used social networking site inside the country, despite reports that it, Twitter, YouTube, and a number of others had been blocked by North Korean censors in April 2016.. Mondays and Tuesdays had the most online activity, the report added.

Criminal links?

The poor security of the domestic internet connections aided the research, with Recorded Future revealing that "less than 1%" of North Korean elite activity was protected from snooping. A number of users relied on virtual private networks (VPNs) via monthly state subscriptions.

These weak safeguards let the teams witness a series of suspicious activity – some of which appeared to be synced with the massive WannaCry ransomware outbreak that was linked to a North Korean cybercrime unit known to the world as "The Lazarus Group".

On 17 May, some mysterious users started to mine bitcoins, a form of cryptocurrency.

"The timing of this mining is important because it began very soon after the May WannaCry ransomware attacks, which the NSA has attributed to North Korea's intelligence service, the Reconnaissance General Bureau (RGB)," the research stated.

"It is not clear who is running the North Korean bitcoin mining operations; however, given the relatively small number of computers in North Korea coupled with the limited IP space, it is not likely this computationally intensive activity is occurring outside of state control."

The North Korean regime has been linked to a series of cyberattacks over the years, the most famous of which was the Sony Pictures hack back in 2014.

The Recorded Future dataset backed up the long-held hypothesis that state-sponsored hackers linked to the elite do not operate from within the country, but instead found that "it is highly likely that North Korea is conducting cyber-operations from third-party countries".

Analysis suggested it uses its political presence in several nations around the world to run cyberespionage operations – including India, Malaysia, New Zealand, Nepal, Kenya, Mozambique, and Indonesia. This is a potential weak spot, the research claimed.

Despite some researchers and scholars saying there may be a connection between North Korean cyber activity and missile launches, the Recorded Future research paper found no such link. Internet activity, at least not yet, cannot be used as a method of predicting the behaviour of the elites.

"While we were not able to examine levels of North Korean malicious cyber activity, for this limited time period using this data set, there does not appear to be a correlation between North Korean internet activity at large and missile tests or launches," the paper said.

When it comes to technology, North Korea tends to be the butt of the joke. The country may starve its citizens and rule over the population with indoctrination and lies, but the latest research suggests that those at the top of the food chain are not as isolated online as once assumed.

Read the full analysis paper here.