A group calling itself the Cheollima Civil Defense (CCD) says it was behind a raid on the North Korean embassy in the Spanish capital Madrid last month in which staff were reportedly shackled and beaten.
According to a Spanish High Court document, the group entered the building on 22 February armed with machetes, knives, metal bars and cable ties and left with two computers, hard drives, USB pen drives and a mobile phone - items said to have been handed to the FBI.
But the organisation, a self-styled human rights group, disputes reports that this was a violent attack, saying that "no weapons were used" and embassy staff were "treated with dignity and necessary caution".
On 28 March the group said it was temporarily suspending operations due to "speculative" media reports.
Despite having a website and YouTube channel, the group has made almost no contact with the world's media, and it remains somewhat in the shadows.
So what do we know about them?
The CCD, which is also known as Free Joseon, describes itself as an "organisation that helps defectors" and is committed to overthrowing North Korea's ruling Kim dynasty.
The word "Cheollima" relates to a mythical winged horse commonly portrayed in Asian mythology, and has been featured in material by the North Korean government to promote economic development, according to AP news agency.
The organisation first hit the headlines in 2017, when it claimed to have provided protection for Kim Jong-un's nephew Kim Han-sol, whose father Kim Jong-nam was assassinated with a nerve agent at an airport in Malaysia.
Kim Han-sol then appeared in a video on the group's YouTube channel, which has received more than two million views.
Just as the trial of Kim Jong-nam's alleged assassins was due to begin, the group managed to spray graffiti over the North Korean embassy in Kuala Lumpur.
Earlier this month, Channel News Asia reporter Sumisha Naidu tweeted an image showing graffiti on the embassy wall in Madrid following the raid, which appeared similar to the logo displayed on the group's website.
The logo on the North Korean embassy’s wall resembles that of the Cheollima Civil Defence Force - the group that sent me a video of #KimJongNam’s son, claiming they had helped him and his family get protection. pic.twitter.com/WCx48eOqlm— Sumisha Naidu (@sumishanaidu) March 11, 2019
In a statement released at the beginning of March, the group declared itself the "interim government" of North Korea, vowing to "overthrow" what it described as a "system of oppression" in the country under Mr Kim's regime.
"This government is a single and just organisation representing the people of North Korea," the statement says.
In a video published on its YouTube channel last week, an individual is filmed ripping famed photos of North Korea's first and second leaders, Kim Il-sung and Kim Jong-il, from a wall and smashing them on the floor.
The size of the organisation, its funding and membership remain unclear, but it does appear to have a wide reach.
What is known about its members?
One member of the group has been named as Adrian Hong Chang, a human rights activist based in the US who co-founded the refugee aid agency Liberty in North Korea.
He was said in court documents to have been the ringleader of the Madrid embassy raid.
Citing a source familiar with Mr Hong Chang, NK News reports that the activist, a Mexican citizen, was "behind this whole Cheollima Civil Defense".
Mr Hong Chang's parents were missionaries to Mexico, the source adds, "I think that's how he got a Mexican passport".
"This latest stunt… he's done something similar in 2006 when he needlessly went to China and got arrested with some North Korean refugees."
According to the court document, Mr Hong Chang is believed to have purchased items from a shop in Madrid prior to the incident, including five pistol holsters, four combat knives, six pellet guns and some protective goggles.
Spanish daily newspaper El País also reports that two members of the group have links with the US Central Intelligence Agency (CIA). The CIA declined to comment to the BBC.
With the identities of group members now being reported, it could prove risky for the CCD to organise further action in the near future.