Researchers discovered files on a North Korean internet server that included animations, written instructions and comments that appear to relate to projects under production for the foreign studios, the report from the Washington-based 38 North project released on Monday said.
Among those projects were "Invincible," an Amazon Original animated series produced by California-based Skybound Entertainment and "Iyanu, Child of Wonder," an anime about a superhero created by Maryland-based YouNeek Studios and due to air this year on HBO Max.
U.S. sanctions prohibit almost all commercial activity between U.S. citizens and North Korean entities.
Michael Barnhart, who works on North Korea issues at Mandiant, a computer security company owned by Google, and worked with 38 North on the project, said there was nothing to indicate the Western companies had knowledge of the arrangements, which appeared to involve subcontracting of work to China.
"There's no way that anyone could have known it, except for the operational security error which exposed it," he said.
Amazon spokespersons declined comment and referred Reuters to Skybound Entertainment.
Skybound said it had no knowledge of any North Korean companies working on its animation, but took the allegations seriously and had initiated a thorough internal review to verify and rectify any potential issues.
"We have also notified the proper authorities and are cooperating with all appropriate bodies," its head of corporate communications Hannah Cosgrove said.
HBO Max and YouNeek did not respond to requests for comment.
The report said that after discovering the files, two researchers kept watch on the server and observed traffic throughout January.
"Each day, a new batch of files would appear that included instructions for animation work and the results of that day's work," the report said.
"Often the files contained editing comments and instructions in Chinese, presumably written by the production company, along with a translation of those instructions into Korean," it said.
"This suggests a go-between was responsible for relaying information between the production companies and the animators."
The report said the identity of the person, or persons, uploading the files could not be determined, nor of the North Korean entity involved.
WESTERN ANIMATION PROJECTS
North Korea's premier animation house is the Pyongyang-based April 26 Animation Studio, also known as SEK Studio, which has worked in the past on international projects. In 2016, the U.S. Treasury Department designated it a North Korean state-owned enterprise and put it under sanctions.
The report noted that in 2021 and 2022 the U.S. government also imposed sanctions on Chinese companies that have worked with the studio or acted as a go-between.
38 North said files found on the server related to a range of projects, including Season 3 of "Invincible." The report said a document on the server carried the name of the series and "Viltruminte Pants LLC," part of the Skybound group.
Working with Mandiant, the researchers examined access logs for the server, which included three internet addresses in China.
Two of the latter were registered to China's Liaoning Province, which neighbors North Korea and where there are many North Korean-operated businesses and North Korean IT workers.
Mandiant's Barnhart told Reuters he assessed "with high confidence" that the animation contracts had been outsourced to North Korea by a front company, apparently in China.
China's Washington embassy said Beijing strictly implemented U.N. prohibitions on dealings with North Korea but added that sanctions were not a solution to the North Korea issue. North Korea's U.N. mission did not respond to a request for comment.
BETTER PAY IN CHINA
Choi Seong-guk, a North Korean defector web cartoonist who worked at SEK Studio between 1996 and 2002, told Reuters the studio had a team assigned for joint work with foreign studios.
Choi, who quit the state-run studio over low pay, said some fellow North Korean cartoonists also left and went to work overseas, mostly in China, where they were construction workers on paper but in reality created animation for Chinese clients.
"By doing that in China, they are paid $100 per month ... compared to $1 back home," he said.
In 2022, the U.S. Departments of State and Treasury and the Federal Bureau of Investigation issued an advisory warning businesses about the risk of inadvertently hiring North Korean IT workers and said this could put them in violation of U.S. and U.N. sanctions.
A spokesperson for the U.S. Treasury said it does not comment on "potential investigations or sanctions violations as general practice" but North Korea's efforts to generate revenue for its weapons programs through cybercrime and abuse of contractors was a concern.
