What to Know About the Shadowy Group That Raided the North Korean Embassy in Madrid

Last month, Spanish media reported that police were investigating after a group of unidentified assailants raided the North Korean Embassy in Madrid.

On Tuesday, the Spanish High Court released a document detailing the Feb. 22 incident. It said 10 people walked into the embassy at around 4:30 pm, carrying machetes, knives and other weapons, and began “shackling” staff and “violently beating” them. They reportedly seized flash drives, two computers, two hard drives and a mobile phone. Most of the individuals left at around 9:40 pm.

The document identified Adrian Hong Chang, a Mexican national and U.S. resident, as the leader of the raid. He was said to have been wearing a jacket with a pin of Kim Jong Un, and tricked police who arrived at the scene into thinking that he was a member of staff at the embassy.

A group called Cheollima Civil Defense has since claimed responsibility for the incident on its website, and said it shared information “of enormous potential value” with the FBI under “mutually agreed terms of confidentiality.” But the group denied that any intimidation was involved, and said claims that individuals brandished weapons and attacked embassy workers were false.

What is Cheollima Civil Defense?

Cheollima Civil Defense (CCD), which also goes by the name ‘Free Joseon,’ calls itself an “organization of refugees who escaped North Korea” that aims to “shake the Kim Jong Un regime.” Its sporadically updated website had its first post on March 7, 2017, which said the group had responded to an “emergency request” to protect the family of Kim Jong Nam, the half-brother of leader Kim Jong Un killed in a nerve agent attack in the Kuala Lumpur airport in February that year.

In the same post, CCD wrote, “If you want to escape or want to share information, we will protect you,” and that the group has “already helped many North Korean people” and expects nothing in return for its services.

Last week, CCD embedded a video posted to its YouTube channel of a person, appeared blurred on camera, violently smashing portraits of the Kim family. The video description read, “Down with Kim family rule! For our people we rise up! Long live Free Joseon!”

The Spanish High Court named Adrian Hong the leader of the group. Who is he?

Adrian Hong is the Managing Director of consultancy firm Pegasus Strategies, a human rights advocate and writer based in the U.S.

Once the Executive Director of Liberty in North Korea, an NGO supporting North Korean refugees, Hong wrote about being arrested in Beijing in 2006 when helping defectors escape through Liaoning, a Chinese province that borders North Korea.

Hannah Song, the CEO of Liberty in North Korea, told TIME via email that Hong co-founded the group as a college student, and has had no involvement with it for more than 10 years.

According to NK News, Hong served as head of the Joseon Institute from 2015, described on its website as a “think tank conducting policy-relevant research and planning” on North Korean affairs. The organization’s Facebook page was last updated in August 2017.

A source familiar with Hong’s activities told NK News that the Joseon Institute was “a cover, probably, to prepare for all of this.”

Hong has also written on North Korea-related topics for publications including New York Times, Foreign Policy and The Atlantic.

Hong did not immediately respond to TIME’s request for comment.

Where do things stand now for Cheollima Civil Defense?

According to the court document, the assailants flew to Portugal after the attack. From there, they took a flight to New York. Hong, however, split from the group and flew to New Jersey. Spain has issued international arrest warrants against him and another suspect, Sam Ryu, who is a U.S. citizen of Korean descent.

The court has labelled the CCD a “criminal organization” for crimes that include burglary, illegal detention and document forgery. On the CCD’s website, the group said Thursday that its operations “are suspended” in the wake of “speculative articles” in media, which it said it never spoke to or shared any information with.