Days before President Trump met with North Korean leader Kim Jong Un in Vietnam, a mysterious incident in Spain threatened to derail the entire high-risk nuclear summit.
In broad daylight, the masked assailants infiltrated the North Korean embassy in Madrid, held up personnel, stole computers and cell phones and fled the scene in two luxury vehicles.
The group behind the operation at the end of February is known as Cheollima Civil Defense, a secret dissident organization committed to overthrowing the Kim dynasty, people familiar with the planning and execution of the mission told the Washington Post.
The alleged role of the group in the attack was not reported previously, and officials from the governments of North Korea, the United States and Spain refused to comment on it.
But in recent days, rumors have swirled about the reasons behind the attack in the Spanish media, including a report in El Pais that claims that two of the masked assailants have ties to the CIA.
People familiar with the incident say that the group did not act in coordination with any government. American intelligence agencies would have been particularly reluctant to do so, given the delicate timing and blatant nature of the mission. But the raid represents the most ambitious operation to date for a dark organization that seeks to undermine the North Korean regime and encourage mass defections, they say.
"This group is the first known resistance movement against North Korea, which makes its activities very interesting," said Sung-Yoon Lee, North Korea expert at Tufts University.
The identity of the assailants is a particularly delicate subject given the delicate nature of the relationship between Trump and Kim.
Trump, who started his presidency by threatening the total annihilation of Kim and his country, has moved to praise the young leader effusively in an attempt to convince him to give up his nuclear program. But after the bankruptcy summit of the two leaders in Hanoi last month, tensions re-emerged, with North Korea's Deputy Foreign Minister threatening Friday to suspend the denuclearization talks.
Any mention of US involvement in an assault on a diplomatic complex could have derailed the talks, a prospect that the CIA would probably have been aware of. "Infiltrating a North Korean embassy days before the nuclear summit would put everyone in danger," said Sue Mi Terry, a former CIA analyst in Korea. "This is not something the CIA would undertake."
The agency declined to comment.
According to Spanish media reports, the attackers tied up the embassy staff, put the hoods on their heads and asked them a series of questions. They spoke in Korean and looked Asian.
More than an hour in the raid, a woman was evaded and her shouts of help alerted a neighbor, who contacted the police. When the authorities arrived at the embassy, a man opened the door and told them that there were no problems. Moments later, the gates of the embassy opened, and the attackers rushed into two embassy cars and ran away, according to local reports. The vehicles were abandoned and found on a nearby road.
Although the incident attracted a flurry of attention from the Spanish media, according to reports, no police report was presented by the embassy or victims.
Experts say computers and phones have seized the amount of the raid to a treasure trove of information that foreign intelligence agencies are likely to seek in the group.
"He could have contacts and documents relating to North Korea's efforts to bypass sanctions and import luxury goods from Europe, which was one of the key tasks of Kim Hyok Chol, the former ambassador of North Korea. in Spain, "said Lee.
Recently, Kim Hyok Chol was reassigned as North Korea's leading man for nuclear negotiations with the United States, making any information about his previous activities particularly coveted by foreign governments.
The attackers also have a video recording that they took during the raid, which they could release at any time, said a person who, like others, spoke on condition of maintaining anonymity to discuss a delicate and illegal operation .
The Cheollima group, which also takes the name of Free Joseon, entered the scene at the end of 2017 after successfully evacuating Kim Jong Un's nephew from Macao after potential threats to his life emerged. The grandson was the son of Kim Jong Nam, the exiled half brother of the North Korean leader murdered in a nerve gas attack at a Malaysia airport in 2017. Kim Jong Nam was believed to have been killed by the regime, making his son a likely target.
Members of the Cheollima group transported Kim Han Sol out of Macao with the help of the governments of the United States, China and the Netherlands, who provided travel and visa assistance, the group told the Wall Street Journal in 2017.
For security reasons, the group leader does not reveal his name and his identity is known only to a small group of people.
In March, the group published a manifesto, urging North Koreans inside and outside the country to resist Pyongyang in large and small ways.
"To those of the system who hear this statement: We ask you to challenge your oppressors. Challenge them openly or hold on in silence," the statement said. "To those who have the same spirit and the same spirit of our diaspora: We ask you to join our revolution."
From the attack on the embassy in Spain, the group claimed responsibility for the disfigurement of the North Korean Embassy in the capital of Malaysia, Kuala Lumpur, on Monday. Authorities said four men wearing hats and masks painted graffiti. The group has not claimed responsibility for the raid in Madrid.
"In its messaging, the group said it had formed a provisional government to replace the regime in Pyongyang," said Terry, who is a scholar at the Center for Strategic and International Studies in Washington. "They have now demonstrated the seriousness of their intent and some capacity to complete the operations. We will see in the coming months the extension of their capacities."
Shane Harris contributed to this report.