A cloud server discovered by NK Internet blog author Nick Roy in 2023 has led to a potential subcontracting digital paper trail to the BBC, Amazon, and HBO Max.
According to recent reports, think tank Stimson Center dived through the seemingly inactive cloud server, discovering many instructions for animation work and logs by artists on what was completed on any given day. These files were uploaded by individuals, which Stimson Center's Martin Williams wrote was evidence of a "go-between" server used for relaying information "between the production companies and the animators."
Mandiant, a cyber security firm owned by Google, searched through the activity logs and found that many of the IP addresses from the individuals accessing the server were masked by a VPN, but instructions for content were frequently written in Chinese and translated to Korean. Content discovered on the server was from season 3 of Amazon's "Invincible", Cartoon Network and HBO Max's "Iyanu, Child of Wonder", and files from the BBC's Octonauts.
It should be noted that Williams states since the content discovered on the server was completed its unknown if it was there because it was used on the show's, or if it was there for other reasons. Researchers behind the deep dive of the server explicitly suspect one North Korean animation studio as likely being behind the content, April 26 Animation Studio, also known as SEK Studio, which is officially sanctioned by the US government.
"There is no evidence to suggest that the companies identified in the images had any knowledge that a part of their project had been subcontracted to North Korean animators," noted Williams