What Would Happen in the Security Teams of Major Corporations on the Day Rumors of Kim Jong-un’s Death Surface?

On October 20, 2026, rumors of the death of North Korean State Affairs Commission Chairman Kim Jong-un suddenly began to spread, primarily on overseas social media.

On October 23, the National Intelligence Service reported to the National Assembly’s Intelligence Committee that it had determined the rumors to be false. North Korean media reported that Kim Jong-un had visited an exhibition in Pyongyang on October 19 and continued to make public appearances thereafter.

When faced with such news, people typically react as follows.

Regular employees search for news.

The PR team verifies the facts.

Senior management assesses the geopolitical implications.

However, in the security teams of large corporations, a slightly different conversation begins.

“Has this started circulating as a phishing lure yet?”

09:07 — A link is posted to the Threat Intel channel

While it varies by company, organizations large enough to have a SOC or CSIRT typically have an internal channel like this.

#soc
#security-incident
#threat-intel
#fraud-monitoring

Someone drops a link.

Unverified reports claiming the death of Kim Jong Un
are rapidly spreading across social media.

They don’t declare it an incident right away.

That’s because there’s no evidence yet that the company has been attacked.

Instead, a new “watch item” is created in the Threat Intelligence system.

Topic:
DPRK leadership / Kim Jong Un death rumor

Potential Abuse:
- Spear phishing
- Fake breaking-news pages
- Credential phishing
- Malware delivery
- Executive impersonation
- Journalist impersonation

There’s a reason for doing this.

Attackers are watching the news, too.

Attackers can sometimes weaponize headlines faster than they can exploit zero-day vulnerabilities.

In large-scale social engineering attacks, the hardest part is often not creating the malware.

It’s getting people to click.

For example, an employee might receive an email like this on a typical day.

Subject: DPRK Leadership Transition — Internal Briefing

Please review the attached assessment before
today's executive briefing.

On a normal day, this would seem quite suspicious.

But what if, for the past few hours, every news outlet and social media platform has been reporting the same story?

Suddenly, it makes sense.

Breaking News
      |
      v
User Curiosity
      |
      v
Urgency
      |
      v
Click

This is a crucial element in social engineering.

A joint advisory issued by the U.S. FBI and NSA, along with South Korea’s National Intelligence Service (NIS), explains that Kimsuky-affiliated attackers continuously modify their spear-phishing content to align with the latest issues being discussed in North Korea expert communities. Tactics involving impersonation of journalists, researchers, and scholars have also been repeatedly observed.

In other words, when news like this breaks, security teams might say,

“It’s fake news.”

But rather,

“We’ve got a good pretext now.”

Below is a scenario of how a company responded when a major news story broke, based on my own experience.

9:15 a.m. — The SOC begins combing through email logs.

They check email security first.

For example, they search for recent inbound emails in systems like Microsoft Defender, Proofpoint, and Mimecast.

Keywords are merely clues for detecting attacks; they do not, in and of themselves, result in a determination of malicious activity.

"Kim Jong Un"
"DPRK"
"North Korea"
"leadership transition"
"breaking report"
"emergency briefing"
"intelligence report"
"succession"

Just because 300 results are found doesn’t mean all 300 are treated as incidents.

Additional criteria are applied.

External Sender
      +
Recent Domain
      +
Attachment
      +
High-value Recipient
      |
      v
Priority Review

In particular, we look at the recipient.

It matters who the email was sent to.

If the same email was sent to all 30,000 employees of a large corporation, it’s likely a typical phishing campaign.

But let’s say it went to exactly six people.

CEO Office
Corporate Strategy
Government Relations
Security Leadership
PR Executive
Overseas Business Director

Now the story changes.

In this case, the target selection—rather than the content—becomes the IOC.

For a senior security engineer, one of the first thoughts that comes to mind in this situation is:

Why these six people, of all people?

That might actually be more important than the email subject line claiming Kim Jong-un is dead.

09:21 — A suspicious email is detected

Let’s say there was an email like this.

From:
Asia Policy Center <briefing@asia-policy-example.org>

Subject:
Urgent DPRK Leadership Assessment

Attachment:
DPRK_Leadership_Assessment_20261020.pdf

At first glance, it looks fine.

It passed the SPF check.

It also has DKIM.

In that case, a SOC analyst shouldn’t just close the case like this.

SPF PASS
DKIM PASS

=> Safe

What these two generally mean is

“This server is authorized to use this domain.”

—not

“The operator of this domain is trustworthy.”

That’s why we look up the domain

WHOIS.

Passive DNS.

Certificate Transparency.

Date the domain was created.

Past reputation.

Connection infrastructure.

Email sending history.

Domain Created:
2026-10-20

First Seen:
2026-10-20

Mail Activity:
First observed today

This domain was created on the day the news broke.

Things are getting a little more interesting.

I’m piecing together these small clues one by one.

New Domain
   +
Relevant Breaking News
   +
Targeted Executives
   +
Document Attachment

We still can’t confirm that it’s malware.

So I’ll take a closer look at the attachment.

09:28 — Nothing shows up in the sandbox

I detonate the file.

Result.

Verdict: Clean

Network Activity: None
Dropped Files: None
Suspicious Processes: None

Moments like this are actually a bit frustrating.

If it’s obvious malware, it’s easy to handle.

But the PDF really looks like a legitimate report on the political situation in North Korea.

It even has a company logo.

The grammar is natural.

Even the graphs look convincing.

There’s just one link on the last page.

Download full intelligence assessment

When the user clicks it, a browser window opens.

09:32 — This is where the attack target changes

The link leads to a page that looks like the Microsoft 365 login page.

The URL is subtle.

login.microsoftonline.com

No,

login-microsoftonline-security.example

it has the same structure.

This is no longer just about malware delivery.

Email
  |
  v
PDF
  |
  v
Fake Login Page
  |
  v
Credential Theft

However, in corporate security in 2026, simply monitoring passwords isn’t enough.

Instead of stealing account passwords,

OAuth Consent
Session Token
Authentication Cookie
Device Code

they might target the same thing.

That’s why they’re calling in the Identity team.

“Isn’t changing the password enough?”

That’s a pretty scary thing to hear in the Incident Response department of a large corporation.

Let’s say we’ve confirmed that a user fell victim to credential phishing.

Here’s the basic response.

Password Reset

But in reality, there’s much more to check.

Active Sessions
Refresh Tokens
OAuth Grants
MFA Changes
Registered Devices
Mailbox Rules
Forwarding Rules
App Passwords
Recent Sign-ins

This is because, in some environments, even after changing the password, the attacker may still retain access if they already have a session.

So, typically,

Reset Password
      |
      v
Revoke Sessions
      |
      v
Review MFA
      |
      v
Review OAuth Grants
      |
      v
Review Sign-in Logs

we proceed to the next step.

09:41 — Now let’s look at the EDR

Let’s say one of the employees who received the email opened the attachment.

In that case, EDR creates a timeline for that host.

What we want to look at is the process tree, not the file name.

OUTLOOK.EXE
     |
     v
AcroRd32.exe
     |
     v
msedge.exe

Up to this point, everything might seem normal.

But if it suddenly changes like this, that’s a different story.

OUTLOOK.EXE
     |
     v
explorer.exe
     |
     v
powershell.exe
     |
     v
rundll32.exe
     |
     v
External Connection

WINWORD.EXE
     |
     v
cmd.exe

Similar parent-child relationships also stand out immediately.

At the stage where the security team is searching for the term “Kim Jong-un,”

they are now looking at something completely different.

09:48 — Initial Assessment

This is where the Senior Security Engineer’s role comes into play.

Let’s say this is the evidence we have.

Targeted phishing: Confirmed

User opened document: Confirmed

Credential submission: Unknown

Endpoint execution: No evidence

Suspicious sign-in: No evidence

Based on this, a decision must be made.

Should the PC be isolated immediately?

Should the account be locked?

Should we terminate all of the user’s sessions?

Should we report this to management?

Should we notify other employees?

Should we purge all instances of the same email from the company’s email system?

Just because something is technically possible doesn’t mean it’s always the right thing to do.

Security teams at large corporations also determine “how aggressively to respond.”

In Incident Response, evidence is often classified as follows.

Confirmed
Likely
Possible
Unlikely
Ruled Out

For example,

Phishing Delivery        Confirmed
Attachment Opened        Confirmed
Credential Theft         Possible
Malware Execution        Unlikely
Account Compromise       Unknown

If accounts are disabled company-wide in this situation, key executives may be unable to perform their duties.

Conversely,

we’ll wait a bit longer before making a decision.

But if it turns out to be an actual compromise, that could give the attacker more time.

The challenge at the senior level isn’t the command itself.

It’s having to make a decision based on incomplete evidence.

10:03 — Pivoting an IOC to the production environment

If one person has been attacked, check whether the same infrastructure was used against others.

Enter the data found in the email into the SIEM.

Sender Domain
Sender IP
URL
File Hash
Attachment Name
Redirect Domain
TLS Certificate
User Agent

Then, extend the data to other security controls.

Email
  |
  +--> DNS
  |
  +--> Proxy
  |
  +--> EDR
  |
  +--> Identity
  |
  +--> Firewall
  |
  +--> Cloud Logs

This process can be viewed as “pivoting.”

There was only one instance in the email.

A DNS search revealed that 18 people had queried the domain.

Seven users accessed the proxy.

Of those, two made it to the login page.

Now the scale of the incident is changing.

10:14 — The entire security team is slowly starting to get involved

It varies by organization, but when an incident escalates, people like these typically get involved.

SOC Analyst
Incident Responder
Threat Intelligence
Detection Engineer
Identity Security
Endpoint Security
Email Security
Network Security
Cloud Security

If necessary,

Legal
Privacy
PR
Corporate Communications
Executive Protection

they get involved as well.

At this point, a “War Room” is set up on Slack or Teams.

#inc-2026-10-dprk-phishing

And the first message goes something like this.

SEV2 Security Incident

Initial Vector:
Targeted spear phishing

Theme:
DPRK leadership / breaking news

Confirmed Impact:
Under investigation

Affected Users:
7

Incident Commander:
Security IR

The important thing here is that this isn’t an “Incident” regarding rumors of Kim Jong-un’s death.

The incident name should, above all, describe the attack.

10:25 — The CEO received the same email

Now, the atmosphere suddenly changes.

Let’s say the CEO is included among the targets of the attack.

This doesn’t necessarily mean the technical risk has increased.

However, the business impact increases.

The CEO’s mailbox usually contains

Board Communication
M&A
Financial Information
Strategy
Executive Contacts
Travel Information

the same data.

The mere fact that the attacker targeted that account requires a reevaluation of the attacker’s motives.

Mass Phishing?

or

Targeted Espionage?

This is because the target of the attack can reveal the attacker’s intent.

10:39 — “Is it a North Korean hacker?”

Someone almost always asks this.

And this is the moment when the security team must be most cautious.

Just because they used rumors of Kim Jong-un’s death as bait doesn’t mean they’re North Korean attackers.

DPRK-themed lure
        !=
DPRK attribution

APT attribution requires much more evidence.

Infrastructure
Malware Family
Code Similarity
TTP
Historical Campaigns
Victimology
Operational Patterns
Intelligence Sources

It has been publicly confirmed that Kimsuky, a group linked to North Korea, has repeatedly carried out spear-phishing attacks by exploiting current issues on the Korean Peninsula and impersonating journalists and scholars.

Furthermore, the NSA, FBI, and U.S. Department of State have issued separate advisories regarding cases where North Korea-linked attackers exploited environments with weak DMARC policies to spoof sender identities and appear as legitimate journalists or researchers.

However, this is

the claim that the attacker in this incident is Kimsuky

is a completely different claim.

The more senior the security team, the longer it takes to make an attribution.

11:07 — A company-wide announcement is issued

However, there’s a problem with the announcement as well.

Sending it like this isn’t ideal.

WARNING

Kim Jong Un has reportedly died.

Do not click related emails.

It ends up being the company itself spreading unverified rumors of a death.

This is the kind of announcement the security team wants.

Security Advisory

We are observing phishing attempts that reference
recent unverified news concerning North Korea.

Do not open unexpected attachments or sign in
through links received by email.

Report suspicious messages through the phishing
reporting function.

The purpose of a security announcement isn’t to report news.

It is to change user behavior.

And you shouldn’t block the news itself

What if we blocked all pages

Kim Jong Un

What if the company’s proxy

That’s not a very good solution.

It would block even legitimate articles.

There would be a huge number of false positives.

Instead, look for signs of an attack.

Recently Registered Domain
        +
Credential Form
        +
Brand Impersonation
        +
Email Referral

The more mature the security system becomes,

Bad Word

rather than blocking it,

Bad Behavior

they try to catch it.

1:20 PM — It seems like the incident is over, but the real work starts now

I deleted the attack email.

I’ve also checked the account.

No malicious sessions were detected.

I’ve blocked the domain.

So, is that it?

No.

Now it’s time for the Detection Engineer to step in.

We need to ensure that an attack like today’s can be detected automatically next time, without requiring human intervention.

For example, we can add detection logic.

Newly Registered Domain
       +
External Email
       +
Executive Recipient
       +
Credential Page

Or, in EDR,

Office Application
       |
       v
Script Interpreter
       |
       v
External Network

we can detect the same behavior more effectively.

If a single detection hasn’t improved by the time an incident is resolved,

it’s a somewhat disappointing response from the security team’s perspective.

2:10 PM — The Purple Team takes a different approach here

Even if an attack didn’t actually occur, issues like this make for good training material.

In Red/Purple Team exercises, you can consider scenarios like this.

Breaking News
      |
      v
Targeted Email
      |
      v
Fake Document
      |
      v
Credential Phishing
      |
      v
Cloud Account Access

Then they ask:

Is it intercepted by the email gateway?

If the user clicks on it, will the proxy catch it?

If the user enters credentials, will Identity Protection detect it?

If an attacker logs in, does it show up in the SIEM?

If OAuth persistence is established, is it detected?

Email
  |
  v
Endpoint
  |
  v
Identity
  |
  v
Cloud

The goal is to see how many opportunities for detection existed throughout the entire attack chain.

And this is “defense in depth.”

It’s not always the case that a single security system is perfect enough to prevent an incident.

Email security can fail.

Email Security: Miss

A user might open a file.

User Awareness: Miss

But EDR can still catch it.

EDR: Detect

If EDR misses it, Identity can catch it.

Identity: Detect

If even Identity is breached, CloudTrail or SIEM might catch it.

Cloud Detection: Detect

Ultimately, the structure is as follows.

Email
  |
  v
Endpoint
  |
  v
Identity
  |
  v
Network
  |
  v
Cloud

Even if one layer fails, the next layer is there.

This is a crucial structure in real-world enterprise security.

A Senior Security Engineer doesn’t just see “a single email.”

To a junior analyst, an incident might look like this.

Suspicious Email

After a little while, it looks like this.

Phishing Campaign

At the senior level, the perspective is broader.

Geopolitical Event
        |
        v
Threat Actor Opportunity
        |
        v
Target Selection
        |
        v
Initial Access
        |
        v
Identity
        |
        v
Corporate Environment

Ultimately, they see just one thing.

The attack path.

The fact that the rumors of Kim Jong-un’s death were false may not be particularly important to the security team.

On October 23, the National Intelligence Service determined that the death rumors were not true.

However, an attacker doesn’t need to verify whether the news is true before launching an attack.

It’s enough that people are paying attention.

True News
    \
     \
      --> Attention --> Click

Rumor
     /
    /

What the attacker needs may not be the truth, but attention.

Ultimately, here’s what happened that day at a major corporation’s security team

In the morning, it was just a rumor on social media.

A few hours later, it could turn into this.

08:50  Breaking News

09:07  Threat Intel Watch

09:15  Email Hunting

09:21  Suspicious Campaign Found

09:32  Credential Phishing Confirmed

09:41  Endpoint Investigation

09:48  Account Risk Assessment

10:03  Enterprise-wide IOC Pivot

10:14  Incident War Room

10:25  Executive Targeting Identified

10:39  Attribution Discussion

11:07  Employee Advisory

13:20  Detection Engineering

14:10  Purple Team Scenario

From the outside, it might just look like

“Rumors of Kim Jong-un’s death were circulating.”

That’s the news.

But from the security team’s perspective,

New Pretext Available

it takes on an additional meaning.

So, when a major news story breaks, the place the SOC checks before news sites is, surprisingly,

the email gateway,

SIEM,

EDR,

or an Identity Provider.

The news team asks:

“Is this true?”

The security team asks a slightly different question.

“So who’s actually using this in an attack right now?”

And perhaps that’s the most “professional” way for a security
team at a large corporation to view the news about what’s happening in the world.