Shuji Sue, Jonathan Brewer & Joost Oliemans

FIELD REPORT
A DPRK missile in Ukraine: results of an inspection by UN Panel experts

Abstract

This field report analyses the results of a technical on-site inspection conducted by three expert members of the UN Panel on Democratic People's Republic of Korea (DPRK) of wreckage from a DPRK missile fired into Ukraine in January 2024. The inspection took place shortly before the Panel was terminated on April 30, 2024, and the experts’ inspection report was leaked to the media. The UN experts recorded the presence of western-origin components, some recently manufactured (and two of which appeared to be counterfeit). The experts' report concluded that the presence of the missile was a violation by the DPRK of Security Council sanctions and, if under the control of Russian forces, was also a violation of Security Council sanctions by the Russian Federation. Such violations were likely to continue, and action was required to identify sources of supply chain compromise.

Table of content

2026

Introduction

1Missiles launched by the Russian Federation at Kharkiv, Ukraine, on January 2, 2024, reportedly included a missile originating in the Democratic People's Republic of Korea (DPRK).¹ Following an invitation by Ukraine to the UN Panel of experts created pursuant to resolution 1874 (2009)²—the DPRK Panel—three Panel experts visited Kyiv from April 17 to 19, 2024, to inspect the wreckage. The objective was to determine whether the missile was indeed of DPRK origin, and to collect data to determine the origin of components and investigate corresponding DPRK procurement networks. Following their return to New York, the experts submitted a mission report to the 1718 Committee on April 25³—with their inspection report attached.⁴

2Earlier, on March 28, 2024, Russia vetoed the draft annual Security Council resolution to renew the mandate of the DPRK Panel. Until then the Panel had published two reports a year describing DPRK's sanctions circumvention methodologies and practices, including guidance on sanctions implementation. Under normal circumstances a record of the inspection, agreed by the Panel as a whole, would have been included in the Panel's biannual report that would have been submitted to the Security Council for publication in August or September 2024.

3The Permanent Representative of Russian Federation to the UN referred to the inspection during a Security Council meeting on June 28, 2024. He said that experts from the United Kingdom, the Republic of Korea (ROK) and Japan had been involved, and that their inspection report was “classic made-to-order material” riddled with numerous procedural errors and logical inconsistencies.⁵

4The April 25 inspection report was leaked to the media: Reuters reported that the three experts had concluded that "debris recovered from a missile that landed in Kharkiv, Ukraine, on January 2, 2024, derives from a DPRK Hwasong-11 series missile" and was in violation of the arms embargo on North Korea. Reuters noted that the three experts found no evidence that the missile was made by Russia. Although the experts “could not independently identify from where the missile was launched, nor by whom”, “Information on the trajectory provided by Ukrainian authorities indicates it was launched within the territory of the Russian Federation.” “Such a location, if the missile was under control of Russian forces, would probably indicate procurement by nationals of the Russian Federation,” which “would be a violation of the arms embargo imposed on North Korea in 2006.”⁶

5Two of the authors of the current paper (S. Sue and J. Brewer) took part in the inspection in Kyiv and the third (J. Oliemans) is an independent DPRK weapons expert. The paper draws on their additional and independent research and analysis following the termination of the Panel. It provides corroboration to the conclusions reached by the Panel experts following the inspection. The paper also looks briefly at how DPRK sanctions circumvention methodologies might develop in future, given DPRK's new relationship with Russia following the June 18, 2024, Treaty on Comprehensive Strategic Partnership between the Russian Federation and the DPRK.

Conduct of the inspection in Kyiv

6Prior to their visit to Kyiv, and in line with standard Panel practice, the Panel experts familiarized themselves with published material on the January 2 missile strike on Kharkiv and held discussions and simulation exercises with the Panel’s ballistic-missile expert and other missile specialists. The experts continued these discussions while in Kyiv.

7The published material included analyses of the missile and its debris by Ukrainian authorities⁷—and by investigators from a UK think tank, Conflict Armaments Research (CAR).⁸ They indicated that the missile belonged to the Hwasong-11 series of DPRK missiles (KN 23/24 in US nomenclature).⁹ These are solid-propellant ballistic missiles approximately 7 or 8.5 meters in length and 110 cm in width (the exact dimensions depending on the model). They are considered short-range missiles with a range of between 660 and 900 km, capable of carrying a warhead possibly weighing close to 500 kg, although variants with heavier warheads and shorter ranges may exist.¹⁰ The Panel had earlier recorded that such missiles were first tested in 2019.¹¹ The nearest Russian equivalent to the KN 23/24 is considered to be the Iskander-M system.¹²

8Although these earlier analyses provided useful background information, while on the ground in Ukraine the experts independently collected their own data based on physical inspection of missile wreckage and components, compilation of an extensive photographic record, and on interviews with Ukrainian authorities.

9According to the authorities, on-site investigations in Kharkiv immediately following the missile attack suggested that the missile was not of Russian origin. For example, the markings were not typical of Russian weapons, the internal wiring did not have the coating normally seen on wiring in Russian missiles, and the manufacturing was crude, perhaps similar to that of a Soviet-era missile.¹³ In line with standard procedures following a missile attack, the authorities had opened a criminal case, initiated forensic investigations, documented the missile body parts and components and transferred these to Kyiv on January 7-8, 2024.

10The experts' subsequent inspection took place at two sites in Kyiv. Missile body parts, including the front and rear parts of a solid fuel engine, three aerodynamic rudders, three gas dynamic rudders (actuators, jet vanes), as well as parts of the cable duct were examined at a Ministry of Defense site on April 17 (Figure 1).

Figure 1: Missile airframe debris laid out by Ukrainian authorities for inspection by Panel experts. The front end of the engine (to the right), the rear end of the engine (to the left), and related components scattered on the ground further to the rear constituted the majority of the debris. The warhead would have been located on the front end of the engine. Source: authors’ image.

11Figure 2 shows the approximate location of some of the body parts on the missile itself.

Figure 2: The approximate locations in the missile of the airframe debris and some of the components inspected by the experts. The elements of the guidance system, for example, fitted into the cavities and housings seen in Figure 7. Source: CSIS Missile Defense Project <https://missilethreat. csis.org/missile/kn-23/> (accessed December 21, 2025), modified by the authors.

12The experts' analyses included comparisons of these body parts with photographs of Hwasong-11 series missiles in the factory that manufactures them, the February 11 Plant. These photographs were taken from images of a visit to the Plant by North Korean Supreme Leader Kim Jong Un on August 11 or 12, 2023, broadcast by the Korea Central News Agency (KCNA) on August 14, 2023.¹⁴

Figure 3: . The front section of the rocket motor inspected in Kyiv by the Panel experts on April 17, 2024. The image is courtesy of Conflict Armament Research (CAR) whose field investigators documented the missile in Kyiv on January 11, 2024. By the time the experts conducted their own inspection some areas of the rocket motor had been cleaned up, and the damaged segment of the rim seen here had broken off or had been removed. Annotations have been added to CAR’s image based on the authors' observations during their inspection. Note the eight connection yokes and twenty bolts (see also Figure 7).

13Separately, electronic components recovered from the missile debris were examined on April 18 at a Ministry of Justice facility where they had been stored following transfer to Kyiv in January.

Inspection results

Engine forward end dimensions

14The experts measured the diameter of the forward end of the engine (Figures 1 and 3) and, taking distortion due to damage into account, estimated this to be about 92 cm. This dimension is somewhat larger than a published estimate of the diameter of Hwasong-11 series missiles (about 85 cm, see Figure 4).

Figure 4: Estimates of the possible dimensions of one of the Hwasong-11 variants (KN-23) (see figure 18 of footnote 16).

15It is however consistent with the diameter we estimate of a Hwasong-11B photographed in flight (about 91.2 cm, see Figure 5).

Figure 5: Top: Launch of a Hwasong-11B missile (Source: KCNA). Bottom: Enlarged image of the missile. If we assume that the diameter of the base of the missile (point A) is 110 cm (as measured by the Panel experts in Kyiv) and that this diameter remains constant along the length of the missile's body to point B (as indicated in Figure 4), then based on the proportions of this image the diameter of the forward end of the engine (point C) is about 91.2 cm. Within the margins of error of this exercise this diameter is equivalent to that estimated by the experts, based on their measurements (92cm).

Engine rear end dimensions

16Based on their own measurements and taking into account the damage to the missile and distortion of its frame, the experts estimated the diameter of the rear end of the engine (Figure 1) was about 110 cm. This dimension is consistent with published estimates of the width of the rear of Hwasong-11 series missiles, between 110 cm (as in Figure 4¹⁵) and 95 cm.¹⁶ The dimension is larger than the estimated equivalent width of the Russian Iskander M (92 cm).¹⁷

17The Panel experts concluded that it was reasonable to assume that the diameters of both rear and forward ends of the missile engine examined in Kyiv were consistent with those of Hwasong-11 series missiles.

Connection yokes

18Eight connection yokes were built into the top of the forward end of the engine, distributed around the inside of the rim (see Figure 3). A similar configuration of connection yokes can be seen on the forward section of motor casings of Hwasong-11 series missiles in the February 11 Plant (Figure 6).¹⁸

Figure 6: The forward end of Hwasong 11 series missile bodies, with their eight connection yokes. Note cable-duct fixings running along the length of the top surface. Source: KCNA.

Engine forward hatch bolts

19Twenty bolts were fixed in a circle to the hatch at the top of the forward end of the missile engine (see Figure 3). This configuration of bolts and the design of the assembly match equivalent features seen on bodies of Hwasong-11 series missiles at the February 11 Plant (Figure 7).

Figure 7: Forward ends of a Hwasong 11 series missile engine on display at the February 11 Plant (KCNA image of August 14, 2023). Compare the similar yokes and bolts in Figure 3. Compare also the cable duct fixings with those in Figure 13. Source: KCNA

Engine forward other fixtures

20Cavities, housings and other features such as holes were built into the outer rim of the forward end of the engine inspected in Kyiv, similar to features seen in KCNA images of 11 February Plant (see Figure 7).

Engine rear nozzle

21The nozzle was fastened to the rear of the engine with a total of 45 bolts (counted by the experts). A similar configuration of bolts can also be seen in images of Hwasong-11 series casings in the February 11 Plant (Figure 8).

Figure 8: Rear end of missile engine: Top left, engine nozzle and 45 fixing bolts as seen on wreckage inspected in Kyiv on 17 April. And as seen on Hwasong-11 series casings in the 11 February Plant: top right, engine nozzle and fixing bolts; bottom, engine and 45 bolt holes. Thick red arrows indicate positions of cable duct fixings, further described in Figure 13 below. Sources: authors’ image (top left); KCNA images broadcast on 14 August 14, 2023 (top right and bottom).

Actuators

22Actuators are components of steering systems mounted on the base of a missile. They are used to adjust the position of the control surfaces (or jet vanes) that sit within the engine's exhaust gases. Missiles typically have four actuators, but the wreckage examined by the Panel experts included only three, two attached to the base of the missile and the third detached. Trapezoidal in shape, they were the only mountings on the base of the missile (Figure 9).

Figure 9: Trapezoid-shaped actuator attached to the base of the missile inspected in Kyiv. The base had no other attachments. Source: authors’ image.

23Trapezoid-shaped actuators can also be seen in photographs of Hwasong-11 series missiles being readied for firing in 2019 (Figure 10, top two images), and also in photographs taken at a “Defense Development Exhibition” in Pyongyang on October 11, 2021 (Figure 10, bottom image). In both cases, the base of the missile has no attachments other than the actuator mounts.

Figure 10: Trapezoid-shaped actuators seen in published images of the Hwasong 11 (KN-23). Note the absence of other mountings on the base of the missiles. Source: KCTV.

24In contrast, actuators mounted on the base of Russian Iskander-M series missiles are rounded in shape (Figure 11). They are often accompanied by other attachments including decoy launchers and small pitch control thrusters.

Figure 11 : Rounded actuators and other attachments on the base of Iskander-M series missiles. Accessed November 26, 2025, <https://mtdata.ru/u1/photo8C9E/20053520154-0/original.png> (from Rossiya-24 News clip, <https://smotrim.ru/video/2401940>, April 2022).

Cable ducts, fixings and grey fabric

25Cable duct fixings can be seen running along the surface of missile bodies in photographs of the 11 February Plant (see Figures 6 and 7). Grey-colored fabric extrudes from the ducts (Figure 12).

Figure 12 : . Grey-colored fabric inside and extruding from missile cable ducts seen in photographs inside the February 11 Plant. Source: KCNA image broadcast August 14, 2023.

26The experts in Kyiv also observed the remains of a cable duct, duct fixings, and, inside the duct, grey-colored fabric (Figure 13).

Figure 13: Cable ducts on the body of the missile wreckage, fixings and grey-colored fabric seen by the experts in Kyiv on April 17. Source: authors’ images.

27Missile guidance section

28The experts recorded the remains of the guidance housing attached to the body of the missile (Figure 14, left). Although the housing was mostly obliterated, some remains could be seen fastened to the missile body with a variety of bolts.

Figure 14: On the right, images published in September 2025 of the guidance section housing of Hwasong 11 series missiles. On the left, an image of the remains of the housing seen during the inspection in Kyiv. Common to both images, as indicated by colored circle. Source: author’s image (left); KCNA (right).

29The orientation of the bolts can be matched with the orientation of bolts seen on images of guidance housing units of Hwasong 11 series missiles published in September 2025 (Figure 14, right).

Other structural similarities

30Although the experts obtained no useable images of the internal structures of the missile's guidance fins during their inspection in Kyiv, according to analysis of information separately obtained by one of the authors, there are close similarities between this internal structure and images of guidance fins of Hwasong-11 series missiles broadcast by KCNA on August 14, 2023.

31Hangul characters

32Hangul characters were present on several components of the missile inspected in Kyiv, for example a barometer was marked with the hangul ㅈ character (Figure 15). This character was previously recorded by the DPRK Panel on a Hwasong-17 missile.¹⁹

Figure 15 : On the left: "A handwritten Korean 'ㅈ' character visible on a barometer, documented by CAR investigators in Ukraine on January 11, 2024" (image and caption courtesy of CAR). This character was also examined by the Panel experts in Kyiv on April 18. On the right, an enlargement of the character.

Roman numerals

33The Panel experts recorded the roman numerals “1120901” on the forward end of the missile engine, and the numerals “112 0801” on an actuator, on an actuator mounting, and on the front part of the missile engine. The Panel had previously interpreted roman numerals on DPRK missile components as representing dates in the Juche calendar, for example “ㅈ 102 1 4” represented January 4 in the Juche year 102.²⁰ Juche year 102 is 2013 in the Gregorian Calendar, so by extension, the roman numerals “112 0801” could indicate a date of August 1, 2023 and “1120901” a date of September 1, 2023. These would presumably be dates of manufacture of those parts of the missile engine.

Other markings

34Although it was not possible to compare details, the shape of cable connectors examined during the inspection in Kyiv (Figure 16) appeared similar to those seen on images of connectors in the February 11 Plant (Figure 12). Markings on the cable connectors in Kyiv included a triangle and a pentagon and similar markings were seen on several other components.

Figure 16: Cable connectors examined by the Panel experts in Kyiv. Distinctive markings highlighted. Source: author’s image.

35In 2009 DPRK military quality control certificates for small arms and light weapons were represented by a triangle, and civilian quality control certificates by a pentagon.²¹ Although Hwasong-11 series missiles do not fall into the category of small arms and light weapons, it seems probable that DPRK quality control marking conventions extend across different weapons-types.

Counterfeit foreign electronic components

36Based on their markings, many of the missile components examined by the experts in Kyiv on April 18 appeared to be of western or other non-DPRK manufacture. This observation is consistent with conclusions of other studies of wreckage from DPRK Hwasong-11 series/KN-23/24 missiles fired into Ukraine.²² But in addition, the experts noted at least two possible examples of counterfeit foreign components. The first: bearings were recorded with markings indicating a specific manufacturer of high-quality bearings. In response to a query by the experts, that manufacturer reported that the bearings were in fact produced by an unrelated manufacturer in a different jurisdiction. The second example was capacitors bearing the name "Rnboycan" (Figure 17).

Figure 17: Component bearing the name "Rnboycan" (note that only the first three letters of this name, Rnb, can be distinguished in this image). Source: author’s image.

37A Japanese manufacturer of capacitors with a similar name, Rubycon, posted a notice on its website that products labelled "Rnboycan" are not made by that company (Figure 18).²³

Figure 18: Warning about counterfeit capacitors bearing the name "Rnboycan", posted on Rubycon's website (date November 26, 2024). Source: Website of Rubycon Corporation.

38Counterfeit components have been recorded in the wreckage of other missiles found in Ukraine, and also in unmanned aerial vehicles.²⁴

DPRK missile in Ukraine compared with Russian Iskander-M series missiles

39The experts checked carefully for evidence that the missile wreckage inspected in Kyiv originated in an Iskander-M series missile of Russian manufacture but found none. In addition to the trapezoidal shape of the actuators described above and the lack of additional mountings on the base of the missile, the experts saw no markings characteristic of Iskander-M series missiles, such as "9M723" (Figure 19), nor any other indications of a possible Russian origin such as Cyrillic script.

Figure 19: Examples of the 9M723 marking characteristic of Iskander M series missiles. On the left: Open Source Munitions Portal (https://osmp.ngo/osmp4/); on the right: "Azerbaijan claims Armenia used Iskander missiles to destroy the city of Shusha", March 31, 2021, Haqqin.az (<https://haqqin.az/news/205714>).

Discussion

Violations of UN sanctions by DPRK and by Russia

40All the evidence available to the Panel experts in Kyiv indicated, first, that the debris they examined derived from a DPRK, not Russian, missile. Hangul characters and the absence of components other than actuators on the base of the missile are strong indicators. Second, that the missile belonged to the Hwasong-11 series. The dimensions of the missile's body and engine, and the configuration of parts such as yokes and bolts constitute strong indicators on this point.

41DPRK is prohibited from exporting items, materials, equipment, goods and technology related to ballistic missile programs, and the presence of such items in Ukraine constituted a violation by the DPRK of resolution 1718 (2006).²⁵ As noted by Reuters, the Panel experts could not independently identify from where the missile was fired, nor by whom. According to information on its trajectory provided by Ukraine authorities the missile was launched from within the Russian Federation, and because UN Member States are prohibited from procuring items, materials, equipment, goods and technology related to DPRK’s ballistic missile programs, this constitutes a violation of resolution 1718 (2006) by the Russian Federation.

Monitoring supply-chain compromise

42The presence of foreign-manufactured components constitutes an additional violation by the DPRK: Resolution 1718 (2006) prohibits transfer to the DPRK of items, materials, equipment, goods and technology related to ballistic missile programs. However, the DPRK's ability to source such components is well-established. The Panel recorded foreign components in a UNHA-3 rocket launched by DPRK in 2012²⁶—but the fact that foreign components seen by the experts in Kyiv were manufactured as recently as 2023 and 2024 shows that such violations are current and continuing.²⁷

43The presence of foreign-manufactured components in DPRK missiles is a stark reminder that supply chain security measures have been compromised. According to one recent study, commercial intermediaries in Hong Kong and China may in some cases be involved.²⁸ The manufacturers, distributors and other intermediaries concerned, together with the relevant authorities, need urgently to remedy the problem.

Counterfeit foreign components

44Apparently counterfeit components in DPRK missiles have been described elsewhere, for example a bearing with the name “JAPAN” found in a DPRK missile recovered in Ukraine prior to March 18, 2024.²⁹ The presence of such components raises important questions. First, DPRK itself possesses semi-conductor manufacturing facilities³⁰—and is interested in expanding and exporting such capabilities, so it is possible that counterfeit components originated in the DPRK itself. But if not, the companies manufacturing these counterfeit components and the Member States in which they are located need to be identified. Second, how many such components in DPRK missiles are in fact counterfeit? Third, are the counterfeit components of equivalent technical quality to the genuine components? Fourth, if the components are of lower quality, do they in fact fall below the export control thresholds of the States in which they are manufactured? For example, do they fall below thresholds set by multilateral export control regimes such as the Missile Technology Control Regime?

45The authors of this paper are not in a position to address these questions further here, but it is important that those with access to counterfeit components do so in order better to understand their scale and impact.

Future DPRK sanctions circumvention and evasion methodologies

46Following termination of the Panel, DPRK is likely to make increased use of tried and tested channels to circumvent sanctions previously documented by the Panel. But additional opportunities may be available following DPRK’s new relationship with Russia. These could include piggybacking on trade channels set up by Russia in response to western sanctions following the invasion of Ukraine.³¹ Not all the countries through which those new trade channels pass will implement western sanctions or have in place strategic trade controls. It may also be difficult for those countries to distinguish items in transit intended for Russia with those intended for DPRK and thus subject to Security Council sanctions.

Monitoring and reporting UNSC DPRK sanctions violations: A continuing requirement

47By monitoring and reporting cases of sanctions violations, the Panel provided States with information needed to identify and take action against such cases in their own jurisdictions. The Panel had no independent enforcement role but helped States to do this themselves, by sending requests for information to the State concerned³²—or by describing violations or attempted violations in its biannual reports.

48Following termination of the Panel a group of States has set up an alternative monitoring mechanism—the Multilateral Sanctions Monitoring Team (MSMT). This has issued two reports to date (March 2026).³³

49It is important that States regard MSMT reports (or those of any other monitoring team) as a reliable and credible alternative to those of the Panel and take action accordingly. The risk otherwise is that the scale and number of violations by DPRK will increase.

Conclusions

50Following an inspection of wreckage of a Hwasong-11 series missile fired at Kharkiv, Ukraine on January 2, 2024, three DPRK Panel experts concluded that DPRK had violated resolution 1718 (2006). On the basis of information provided by Ukraine authorities that the missile was fired from inside Russia, the experts concluded that Russia would also have violated resolution 1718 (2006).

51The presence of foreign components amongst the missile wreckage inspected in Kyiv, some of recent manufacture, is clear evidence that Security Council prohibitions on DPRK's procurement of proliferation-sensitive items are not effectively implemented by all UN Member States. Member States and the relevant international organizations need urgently to put in place better systems for compliance with Security Council resolutions, at all points in supply chains.

52In the absence of a Panel the scale and number of DPRK's sanctions violations is likely to increase. In parallel, Russia's relationship with DPRK is likely to open further channels for DPRK's illicit procurement activities. Implementation of Security Council sanctions remains obligatory, but identifying and monitoring DPRK's violations will be increasingly challenging.

Notes

To cite this article

About: Shuji Sue

About: Jonathan Brewer

About: Joost Oliemans