The group’s alleged role in the attack has not previously been reported, and officials from the governments of North Korea, the United States and Spain declined to comment on it.

But in recent days, rumours have swirled about the motivations behind the attack in the Spanish media, including a report in El País alleging that two of the masked assailants have ties to the CIA.

Kim Jong-un looks like he going to launch a rocket. Is it just a bluff?

People familiar with the incident say the group did not act in coordination with any governments. American intelligence agencies would have been especially reluctant to do so given the mission’s sensitive timing and brazen nature. But the raid represents the most ambitious operation to date for an obscure organisation that seeks to undermine the North Korean regime and encourage mass defections, they say.

“This group is the first known resistance movement against North Korea, which makes its activities very newsworthy,” said Sung-Yoon Lee, a North Korea expert at Tufts University.

The identity of the assailants is a particularly sensitive topic given the delicate nature of Trump and Kim’s relationship.

Trump, who began his presidency by threatening the total annihilation of Kim and his country, has shifted to effusive praise for the young leader as he tries to convince him to give up his nuclear program. But in the aftermath of the two leader’s failed summit in Hanoi last month, tensions have re-emerged, with North Korea’s vice-foreign minister threatening on Friday to suspend the denuclearisation talks.

Any hint of US involvement in an assault on a diplomatic compound could have derailed the talks, a prospect the CIA would likely be mindful of.

“Infiltrating a North Korean embassy days before the nuclear summit would throw that all into jeopardy,” said Sue Mi Terry, a former Korea analyst at the CIA. “This is not something the CIA would undertake.”

The agency declined to comment.

According to Spanish media reports, the assailants tied up the embassy staff, put hoods over their heads and asked them a series of questions. They spoke in Korean and appeared to be Asian.

More than an hour into the raid, a woman reportedly escaped and her screams for help alerted a neighbour, who contacted police. When authorities arrived at the embassy, a man opened the door and told them there was no problem. Moments later, the embassy gates opened, and the assailants dashed out to two embassy cars and sped away, according to local reports. The vehicles were abandoned and found on a nearby street.

Though the incident has attracted a flurry of Spanish media attention, no police reports were filed by the embassy or the victims, according to the reports.

Experts say the computers and phones seized in the raid amount to a treasure trove of information that foreign intelligence agencies are likely to seek out from the group.

“It could have contacts and documents related to North Korea’s efforts to bypass sanctions and import luxury goods from Europe, which was one of the key assignments for Kim Hyok-chol, the former North Korean ambassador to Spain,” Lee said.

Recently, Kim Hyok-chol was reassigned as North Korea’s point man for the nuclear negotiations with the US, making any information about his previous activities especially coveted by foreign governments.

Trump open to third summit with Kim but none planned, adviser says

The assailants also possess a video recording they took during the raid, which they could release at any time, said one person who like others spoke on the condition of anonymity to discuss a sensitive and illegal operation.

The Cheollima group, which also goes by the name Free Joseon, first came to prominence in late 2017 after it successfully evacuated the nephew of Kim Jong-un from Macau after potential threats to his life surfaced. The nephew was the son of Kim Jong-nam, the North Korean leader’s exiled half-brother who was assassinated in a 2017 nerve gas attack in a Malaysian airport. Kim Jong-nam is widely believed to have been killed by the regime, making his son a likely target.

Members of the Cheollima group transported Kim Han-sol out of Macau with the help of the governments of the US, China and the Netherlands, which provided travel and visa assistance, the group told The Wall Street Journal in 2017.

For safety reasons, the leader of the group does not disclose his name, and his identity is known only to a small group of people.

In March, the group published a manifesto, calling on North Koreans inside and outside the country to resist Pyongyang in ways big and small.

“To those within the system who hear this declaration: we call on you to defy your oppressors. Challenge them openly or resist them quietly,” the declaration said. “To those of like-mind and like-spirit of our diaspora: we call upon you to join our revolution.”

Since the attack on the embassy in Spain, the group has asserted responsibility for the defacing of the North Korean Embassy in Malaysia’s capital, Kuala Lumpur, on Monday. Authorities said four men who wore hats and face masks painted the graffiti. The group has not claimed responsibility for the raid in Madrid.

“In its messaging, the group said they have formed a provisional government to replace the regime in Pyongyang,” said Terry, who is a scholar at the Centre for Strategic and International Studies in Washington. “They have now shown the seriousness of their intent and some capabilities to carry out operations. We will see in the coming months the extent of their capabilities.”