The leader of the alleged intruders appears to be a Yale-educated human rights activist who was once jailed in China while trying to rescue North Korean defectors living in hiding, according to activists and defectors.
Details have begun trickling out about the raid after a Spanish judge lifted a secrecy order Tuesday and said an investigation of what happened on Feb. 22 uncovered evidence that "a criminal organization" shackled and gagged embassy staff before escaping with computers, hard drives and documents. A U.S. official said the group is named Cheollima Civil Defense, a little-known organization that recently called for international solidarity in the fight against dictatorship in North Korea.
Here's a look at the intruders and the Cheollima group.
Details about the creation of the Cheollima Civil Defense group are hazy. The word "Cheollima" — spelled "Chollima" in the North — refers to a mythical winged horse that the government often uses in its propaganda.
In a statement posted on its website on Thursday, the group said it has "temporarily suspended" its activities because of what it described as an "attack of various speculative articles by the media." The group said it consists of North Korean defectors living in countries around the world, but that it has not worked with or contacted defectors "living under tight security" in South Korea.
"We ask the media to restrain their interest about the truth of our organization or its members. There are bigger things ahead of us," Cheollima said in a statement written in Korean. "We are an international organization unified by determination to cut off the dynastic power of the Kim family."
In March 2017, the group said it had arranged the escape of Kim Han Sol, the son of Kim Jong Nam, the half brother of North Korean leader Kim Jong Un who was assassinated at a Malaysian airport earlier that year.
A man claiming to be Kim Han Sol appeared in a YouTube video at the time and said he was safely with his mother and sister.
"My name is Kim Han Sol from North Korea, part of the Kim family," the man said in English in the 40-second video clip. "My father has been killed a few days ago."
Recently the group declared on what appears to be its website the establishment of "Free Joseon," which it described as "a provisional government" that would fight against "the criminal incumbents of the north." North Korea still calls itself "Joson," its spelling of "Joseon," the name of the dynasty that ruled the Korean Peninsula for more than 500 years.
The group also recently posted a video showing an unidentified man destroying glass-encased portraits of North Korea's two late leaders. South Korean media reported that the group was behind the writing of "Let's topple Kim Jong Un," the current North Korean leader, on the wall of the North Korean Embassy in Malaysia.
After the Spanish judge released documents about the Feb. 22 incident, the Cheollima website said it had been responding to an urgent situation at the embassy and was invited onto the property, and that "no one was gagged or beaten." The group said there were "no other governments involved with or aware of our activity until after the event."
The Spanish court report said the intruders urged North Korea's only accredited diplomat in Spain, So Yun Sok, to defect.
The Cheollima website said the group shared "certain information of enormous potential value" with the FBI, under mutually agreed terms of confidentiality.
The FBI said its standard practice is to neither confirm nor deny the existence of investigations.
If Cheollima was behind the embassy break-in, it indicates the involvement of North Korean defectors who have experience working for North Korea's military or security authorities, said Nam Sung Wook, a former president of the Institute for National Security Strategy, a think tank affiliated with South Korea's main spy agency.
"There are many young North Korean men who come to the South with more than 10 years of military experience," said Nam, who now teaches at Korea University in South Korea. "People would be surprised at what they are capable of doing, and they aren't always being closely watched by the South Korean government."
THE ALLEGED LEADER
A Spanish court document identified the leader of the group that entered the embassy as Adrian Hong Chang.
This is likely to be Adrian Hong, who in 2005 co-founded Liberty in North Korea (LiNK), an activist group devoted to rescuing North Korean refugees, according to North Korean defectors and activists who spoke with The Associated Press.
Hannah Song, CEO of LiNK, said Hong has had no involvement with the organization for more than 10 years. "We have no knowledge of his recent activities," Song said.
The Spanish judge, Jose de la Mata, described Adrian Hong Chang as a Mexican national and resident of the United States. According to the Spanish court report, the man flew to the United States on Feb. 23, got in touch with the FBI and offered to share material and videos. The report didn't say what type of information the items contained or whether the FBI accepted the offer.
An online message by AP to a verified Twitter account linked to activist Adrian Hong wasn't immediately answered.
Hong is known for his work helping North Koreans flee their homeland and resettle in South Korea and elsewhere. LiNK said it has helped more than 1,000 North Koreans reach safety. Fellow activists and North Korean defectors said Hong was detained in China briefly in the 2000s because of his work.
Kang Chol-hwan, a prominent North Korean defector-turned-activist, said he was close to Hong and helped him with LiNK.
Kang, an ex-inmate of North Korea's notorious Yodok prison camp, said Hong became passionate about North Korean human rights after reading his detention memoir. He said Hong visited Seoul and rallied against what he believed were pro-North Korea sympathizers and those silent on North Korean human rights issues.
Kang, who said he last saw Hong about five years ago, said Hong wanted to "muster anti-government forces (in North Korea) and bring down North Korea from the inside." Kang said Hong even went to Libya to study the fall of dictator Moammar Gadhafi so he could explore ways to topple the Kim government.
Kang believes Hong heads the whole Cheollima group.
"He has great capacity for organization because of his experience establishing LiNK," Kang said. "He's a very smart guy."
Fellow defector-turned-activist Heu Kang Il, who met Hong around 2005, recalled him as a "passionate young man."
Testifying before the Canadian Senate in 2016, Hong said: "North Korea is not a normal nation with the government seeking to serve and protect its citizens. It is a brutal totalitarian regime, ruled by a royal family and a class of vassals, both in tenuous concert with one another. It does not care for the welfare of its people."
In an op-ed for The Christian Science Monitor in 2014, Hong said the international community must support "efforts to strengthen meaningful opposition and civil society in the country, training exiles to one day assume leadership positions, educating younger refugees, and creating more robust programs to help defectors adjust to life on the outside."
"A class of Korean technocrats must be capable of stabilizing and rebuilding on a national scale," Hong wrote.
Associated Press writer Aritz Parra in Madrid contributed to this report.