By Josh Smith and Hyonhee Shin

SEOUL (Reuters) – A shadowy group seeking to overthrow North Korean leader Kim Jong Un has been thrust into the international spotlight after a Spanish court investigating a break-in at North Korea’s embassy in Madrid named apparent members as suspects.

Cheollima Civil Defense, also known as Free Joseon, first went public in 2017, when it said it was protecting the family of Kim Jong Un’s half brother Kim Jong Nam, who was murdered in a Malaysian airport.

Spanish authorities unsealed court documents on Tuesday accusing at least 10 individuals of storming into the embassy, restraining and beating some staff members and holding them hostage for hours before fleeing with stolen computers and hard drives. Such an action would be one of the most militant operations ever carried out by activists opposed to North Korea’s government.

“Parties seeking to ‘out’ those in Madrid have painted a target on the backs of those seeking only to protect others,” Cheollima Civil Defense said in a website post, apparently acknowledging for the first time its involvement in the raid. “They have chosen to side with Pyongyang’s criminal, totalitarian rulers over their victims.”

It disputed police allegations that weapons or violence were used in the break-in.

Lee Wolosky, an American attorney who represents Free Joseon, said in a statement that the Spanish court “purported to reach conclusions without any input from representatives” of the group.

“There are a number of statements attributed to the judge in media reports that do not accurately reflect what happened in Madrid,” he continued, without elaborating. “It was, in any event, highly irresponsible to disclose publicly the names of people who are working in opposition to a brutal regime that routinely and summarily executes its enemies.”

Of the 10 suspects, the documents listed the names and birth dates of seven, including citizens of Mexico, the United States, and South Korea. All but one are under 30 years old.

The identification of at least some of the individuals in the group may have undermined their cause and perhaps endangered their lives, analysts and activists said.

“It was too risky,” said one South Korean human rights activist who previously worked with one of the suspects. “Now that their identities are known, they won’t be able to carry out activities as before.”

NORTH KOREA ACTIVIST

The Mexican national named by Spanish authorities as one of the embassy raid’s leaders, Adrian Hong, is a longtime activist who helped found the refugee aid organization Liberty in North Korea (LiNK), and later led an organization preparing for an “imminent, dramatic change” in the country, analysts said.

Spanish court documents said Hong played a leading role in the break-in, and that after fleeing to the United States he contacted the FBI to offer information that had been stolen.

Hong could not be reached for immediate comment.

Hong was among several LiNK activists who were arrested and deported from China in late 2006 as they were trying to help a party of North Korean refugees escape.

In a statement on Tuesday, LiNK said Hong had not been involved in any way with the group for more than 10 years and LiNK had no information on his current activities.

Hong told a newspaper in the United Arab Emirates in 2011 that the Arab Spring uprisings then unfolding were “a dress rehearsal for North Korea”.

Kang Cheol-hwan, a defector and founder of the North Korea Strategy Centre in Seoul, said Hong went so far as to travel to Libya to research the aftermath of Muammar Gaddafi’s ouster.

FREE JOSEON

Cheollima Civil Defense takes its name from a winged horse commonly featured in East Asian mythology. Free Joseon, meanwhile, references the last Korean dynasty, and a name that North Korea still often uses to refer to itself.

On its website, the group used soaring language to declare itself the “a provisional government” of Free Joseon as “the sole legitimate representative of the Korean people of the north.”

The website also began to sell “post-liberation blockchain visas” that can be bought with cryptocurrency, and on March 11 it claimed responsibility for defacing the North Korean embassy in Kuala Lumpur.

North Korea has not publicly commented on the Madrid break-in, nor filed a complaint with Spanish police.

The group’s brazen actions led some to speculate that there could be serious dissent against Kim Jong Un taking shape. But other analysts were more skeptical, and say there are lingering questions over possible ties to foreign intelligence agencies.

“I’m still inclined to believe there was some professional involvement because taking over a foreign mission is not an easy operation,” said Korea Risk Group director Andrei Lankov.

“They took computers and hard disks, but if you don’t have highly specialized capabilities for breaking the codes, it’s probably not going to be useful to anyone but major intelligence agencies.”

Cheollima Civil Defense said on Tuesday that no governments were involved or were aware of the embassy operation beforehand. It said it had shared “certain information of enormous potential value” with the FBI at the agency’s request, but that agreements of confidentiality “appear to have been broken”.

The U.S. State department said on Tuesday the U.S. government was not involved in the raid.

(Reporting by Josh Smith and Hyonhee Shin; Jonathan Landay contributed from Washington; Editing by Alex Richardson and Jonathan Oatis)