Mapping North Korea’s Illicit Shipping Networks with GEOINT and Maltego

This blog is co-writeen by the Open Source Centre (OSC) and Maltego.

The Open Source Centre (OSC) is a UK-based non-profit that uses publicly accessible information to produce open-source research on some of the world’s most pressing security challenges and threats facing democratic societies. Its mission-driven team of analysts, engineers, and technologists investigates global illicit networks and develops tools and training that help others do the same.

As part of the Maltego Grants Program, OSC uses Maltego Graph to connect fragmented evidence, uncover relationships across complex networks, and strengthen investigations where understanding not only who is involved, but also where activity takes place, can be critical.

Following North Korea’s Illicit Coal Trade 🔗︎

In 2016 and 2017, the United Nations Security Council (UNSC) adopted a series of resolutions strengthening sanctions against North Korea in response to the country’s continued nuclear testing and ballistic missile activities (UN Security Council, 2016–2017). Many of these measures targeted revenue-generating sectors, including the export of natural resources such as coal and iron ore.

In the years since, North Korea has continued to adapt its maritime activities to evade these restrictions. In 2025, OSC published an investigation documenting foreign-flagged vessels using advanced spoofing techniques to illicitly export coal from North Korea. OSC later presented its findings to the UNSC, highlighting the continued evolution of maritime sanctions-evasion tactics.

OSC identified at least six foreign-flagged vessels loading coal in North Korean ports before transporting it abroad, predominantly to China. The investigation combined Automatic Identification System (AIS) data with satellite imagery to establish vessel activity and movement.

From Geolocation to GEOINT 🔗︎

This investigation illustrates an important distinction in modern geospatial intelligence (GEOINT). Geolocation can answer where a vessel, device, image, or activity was observed. GEOINT goes further by asking what that location reveals about movement, relationships, access, behavior, and the wider intelligence question.

As explored in Maltego’s recent white paper, “Debunking Myths about Geolocation Investigations,” modern GEOINT is increasingly a fusion discipline. Satellite imagery, AIS and other tracking data, open maps, corporate records, digital identifiers, social media, public sensors, and other sources may each reveal only one part of an event. The analytical value comes from connecting, verifying, and interpreting those pieces together.

For OSC, AIS data and satellite imagery helped establish where the vessels were operating, but the vessels themselves represented only the visible layer of a much broader network. Behind them were companies, intermediaries, individuals, digital infrastructure, and historical relationships that required further investigations to uncover.

Using Maltego Graph to Connect the Network Behind the Vessels 🔗︎

During an investigation, OSC collects identifiers associated with the vessels and the wider network, such as vessel names and IMO numbers, company records, individuals, domains, contact information, and other digital or corporate infrastructure. Analysts then import these data points into Maltego Graph, where they map the entities and their relationships using OSC’s in-house ontology. This allows them to connect vessels to the companies, individuals, and infrastructure behind their operations and identify relationships that may warrant further investigation.

This becomes especially important as networks expand. Front companies, intermediary entities, individuals, vessels, contact details, and infrastructure can quickly turn an investigation into a large and difficult-to-navigate dataset. Maltego Graph helps the team structure this information and identify duplicate or shared identifiers that may connect entities which initially appear unrelated.

The platform also allows investigators to enrich their initial data and uncover additional connections using Maltego’s curated data sources available through Data Pass. Additional email addresses, phone numbers, websites, IP addresses, and other digital identifiers can be analyzed and assessed alongside the original evidence. In practice, these pivots can expose shared corporate or digital infrastructure that would otherwise be time-consuming to collect or easy to overlook.

This reflects a core principle of effective GEOINT: a coordinate, vessel track, or satellite image is not a conclusion on its own. Evidence becomes more valuable when analysts can connect geographic activity to the people, organizations, infrastructure, and events that give it context. Maltego provides an environment where those different evidence types can be fused and explored as part of the same investigation.

Finding Connections Across Current and Historical Networks 🔗︎

Maltego Graph’s link analysis and network visualization capabilities also help OSC prioritize where to investigate next. By assessing entities based on factors such as the number of connections they have, analysts can identify highly connected companies, individuals, or identifiers and examine their role within the wider network.

Beyond identifying connections within the immediate network, OSC can also compare new findings against years of investigative data accumulated in Maltego. This helps analysts determine whether newly identified entities connect to previously investigated networks, including operators and facilitators historically associated with North Korean activity.

The result is a more complete view of the network behind the vessels. OSC can assess vessel movements alongside corporate relationships, digital infrastructure, contact information, and historical connections, allowing analysts to move beyond where a vessel travelled to understand who is connected to its activity, how those entities are linked, and what those relationships reveal about the wider network.

Turning Investigative Findings into Impact 🔗︎

OSC continued building on its initial investigation and briefed the UNSC for a second time on 30 April 2026, presenting evidence of illicit North Korean coal smuggling.

The findings contributed to a joint statement issued by the Governments of the United States, Canada, France, Germany, Italy, Japan, New Zealand, the Republic of Korea, the United Kingdom, and the European External Action Service of the European Union, calling for accountability and nominating the vessels for further designations.

This investigation shows how different intelligence sources can answer different parts of the same question. AIS data helps trace where vessels traveled and when. Satellite imagery provides additional context around activity at specific locations. Corporate and digital records help identify the organizations, individuals, and infrastructure connected to those vessels. Bringing these findings together through link analysis makes it easier to uncover relationships across the network and identify connections that may not be visible from any single source alone.

Conclusion 🔗︎

OSC’s investigation highlights how combining multiple intelligence sources with graph analytics can help analysts uncover patterns, develop evidence-based hypotheses, and move beyond isolated observations to investigate complex illicit networks. Geography provides an essential layer for understanding movement and activity, but a fuller intelligence picture emerges when geospatial evidence is connected with digital identifiers, corporate records, and other open-source intelligence.

With support from the Maltego Grants Program, OSC can continue using the Maltego platform to connect geospatial and open-source intelligence, turning fragmented investigative findings into meaningful insights that can support accountability and real-world action.