That group is the Cheollima Civil Defence, according to a US official. The shadowy activists have the self-declared mission of helping defectors of the North Korean regime.
The court document said Hong Chang flew to the US on February 23, where he got in touch with the FBI and offered to share material and videos with federal investigators. The Spanish investigation didn't say what the content of the material was, or whether the FBI accepted it.
The document added that most suspects were believed to be outside Spain.
The FBI said in a statement that its standard practice is not to confirm nor deny the existence of investigations but added that "the FBI enjoys a strong working relationship with our Spanish law enforcement partners."
A police spokesman confirmed to AP that arrest warrants had been issued against Hong Chang and one other suspect. No formal charges have yet been brought into the attack.
So, the North Korean diplomat, didn't respond to written questions from AP and declined to talk to reporters during a recent encounter outside his embassy.
Others identified as part of the assailants' group were Sam Ryu, from the US, and Woo Ran Lee, a South Korean citizen. Their whereabouts and their hometowns weren't immediately known.
The South Korean Embassy in Madrid said it had no knowledge of the events and couldn't offer further comment.
The assailants purchased knives and handgun mock-ups when they visited Madrid in early February, according to the investigation, and later used them for the attack.
While in Madrid, Hong Chang also applied for a new passport at the Mexican Embassy, the investigation found, and used the name "Oswaldo Trump" to register in the Uber ride-hailing app.
The North Korean Embassy hasn't pressed charges in Spain, and officials in Pyongyang haven't officially commented on the attack.
Spanish police first found out about the incident after the wife of one of the embassy's workers managed to escape by jumping from a window.
When confronted by Spanish police officers who went to check on the embassy, Hong Chang posed as an embassy official and said everything was normal. That paved the way for the group's escape in the embassy's cars.
The attack's timing, barely a week before a high-stakes US-North Korea summit on denuclearization was derailed in Hanoi on February 28, had led many to speculate that it was an attempt to obtain data related to the North's former ambassador to Spain.
Kim Hyok Chol, who was expelled from Spain in September 2017 following Pyongyang's sixth round of nuclear tests and missile launches over neighboring Japan, has become North Korea's top nuclear negotiator with the US.
Last week, the rights group that allegedly led the attack posted a short video on its website allegedly showing a man shattering against the floor portraits of North Korean late leaders Kim Il Sung and Kim Jong Il.
- AP