These 3 providers are the most used VPNs in North Korea

People in North Korea are increasingly turning to the best VPN apps to bypass strict local censorship and avoid domestic surveillance.

This is the finding of a new report by Recorded Future’s Insikt Group’s threat research division to analyze local internet users' behavior.

Three top providers are among the most used VPN apps. Researchers found that North Koreans "overwhelmingly" use Hotspot Shield (63.2% of users), followed by ExpressVPN (16.1%) and Private Internet Access (10.6%).

Why do North Korean use VPNs? 

North Korea is infamous for enforcing strict control over the national internet. Surveillance is pervasive, Freedom House noted in its 2024 index, with nearly all forms of private communication being monitored. As expected online censorship levels are very high, too, making a circumvention tool a necessity to be able to connect with the open web.

As the report reads, "While we observed North Koreans continuing to use VPN and proxy services, this is the first time we have seen North Koreans likely using obfuscation services to avoid domestic surveillance or censorship, demonstrating an increased awareness of operational security for online activities of which the regime disapproves."

A virtual private network (VPN) is security software that both encrypts your online activities and spoofs your IP address location. This means that, while boosting online anonymity, VPNs can also trick your internet service provider (ISP) into thinking you're browsing the web from a completely different country. Ultimately, this will grant you access to otherwise geo-restricted content.

While a proxy service also spoofs your IP by rerouting your internet traffic through its servers, it doesn't secure your data inside an encrypted tunnel. Put simply, a proxy is a forwarding service that can help you bypass geo-restrictions, but it doesn't necessarily prevent online monitoring. 

"We saw 31 unique North Korean IP addresses communicating with 35 different VPN or proxy services," wrote researchers, adding that, of all the proxies, researchers found that Psiphon 3 was the most popular among North Koreans.

The investigation shows that the use of foreign antivirus products is also high among North Koreans, with people especially turning towards McAfee antivirus tools.

This finding, according to researchers, indicates that "some North Koreans are concerned about cybersecurity."

The team Recorded Future analyzed internet behaviors between January 2023 and March 2024 to, as they explain, focus on a timeframe with little to no foreign presence in the country.

It's worth noting, though, that some external experts have raised some concerns about the report’s methodology and comprehensiveness. Talking to NK News, Martyn Williams, a senior fellow at the Stimson Center, said: "I’m not suggesting the data is flawed, but I think with such unique data, a little more explanation of what it is, how it was cleaned and how it was gathered is needed."

Williams also expressed perplexities over the use of McAfee products among North Koreans considering that this would require credit cards, raising questions of whether the users may be foreigners instead.