Following the publication of a report in July 2017, North Korea's elites, some of the country's few citizens allowed on the Internet, have greatly altered their online behavior, and are now obfuscating their browsing activity, and have ditched US websites like Facebook or Instagram for alternative Chinese social networks.
The company at the base of these findings is US threat intelligence firm Recorded Future. The company's engineers have been passively tracking and analyzing Internet traffic from North Koreans inside and outside the country's borders since April 2017.
They published an initial report last summer, highlighting how the very few North Koreans that were allowed to surf the world wide web were no different than any other user.
The report showed that North Koreans liked to spend most of their time streaming videos, playing games, interacting on social networks, or watching porn.
But the report appears to have made it into the North Korean government's hands as well, because, between December 2017 and March 2018, the same researchers spotted a major shift in online behavior.
The biggest change was that the amount of obfuscated traffic has grown from 1 percent in July 2017 to nearly 13 percent in March this year. Obfuscated traffic is web activity hidden behind encrypted HTTPS connections, under Tor clients, or VPN, VPS, or other tunneling protocols (known as PPTPs).
There was a clear indication that those very few North Koreans allowed to surf the Internet were clearly told to hide their activity whenever possible.
Furthermore, authorities appear to have also instructed users to stop hanging around on US social networks. Nowadays, North Koreans are avid users of Alibaba, Tencent, and Baidu.
"In July, our data demonstrated that North Korean leadership heavily consumed Western social media, especially Facebook, Google, and Instagram," says Recorded Future analyst Priscilla Moriuchi. "In fact, Facebook was by far the most popular service, with more than double the daily actual usage than any of its Chinese-language counterparts."
Nowadays, things have dramatically changed, so much so that Facebook and Instagram activity had diminished so much, it wasn't even visible on a Recorded Future chart.
The same report also revealed that besides Bitcoin, North Koreans are now also mining Monero from inside the country's borders.