The bizarre assassination of North Korean leader Kim Jong Un's estranged half-brother marks a departure from the isolated country's repertoire of overseas operations, according to experts on its opaque ruling structures.

Kim Jong Nam died last week after being assaulted at the airport in the Malaysian capital with what police believe was a fast-acting poison. The two women who authorities say assaulted him, one Indonesian and the other who carried a Vietnamese passport, are both in custody.

South Korea has said that it believes the assassination was coordinated by a shadowy North Korean agency called the Reconnaissance General Bureau (RGB).

The RGB is North Korea's "premier intelligence organisation", according to the United Nations, which sanctioned it in March last year for its role in North Korea's arms trade.

But given the high profile of Kim, who had spoken out publicly against his family's dynastic control, his murder could have been a joint operation between different agencies, said Michael Madden, an expert on the North Korean leadership.

"The RGB is just one of many possibilities. It will take another week at least to pinpoint the organisations involved," said Madden.

On Wednesday, Malaysian police arrested 47-year-old Ri Jong Chol, a North Korean who had a Malaysian work visa for a small herbal medicine firm and lived in Kuala Lumpur with his wife and two children.

The use of North Koreans based overseas like Ri has the hallmarks of an operation by elite spy training unit "Office 35", said Jang Jin-sung, a defector who had worked in the United Front Department of the Workers' Party, which along with Office 35, is an espionage unit within the ruling party.

"They produce people with real jobs and skills and send them abroad with family to live," said Jang. "When an urgent opportunity arises like this one on Kim Jong Nam, those people are tapped into operation, so they would be planted way before hand."

Madden said some North Korean operatives were "free agents", used as the need arose.

North Korea also stations at least one member of its State Security Department or "bowibu" at its larger overseas missions, Thae Yong Ho, North Korea's former deputy ambassador to Britain, told Reuters this month.

That security official usually has a direct line to Pyongyang, and takes orders from the Central Committee of the Workers' Party, as well as the bowibu.

Malaysian police identified a senior official in the North Korean embassy on Wednesday as a suspect in the murder.

CYANIDE CIGARETTE

If the Workers' Party is the brains behind North Korean assassinations, the muscle is the Reconnaissance General Bureau which formally falls under the military.

North Korean intelligence agencies have a history of carrying out at times violent overseas operations, usually against South Korean targets.

In 1968, commandos from Unit 124 of what was then just called the Reconnaissance Bureau got within several hundred metres of the South Korean presidential palace, with orders to kill the then president, Park Chung Hee.

"There's a five decade history here and a lot of institutional and operational memory," said Madden. "These people learned under tough, hardened spymasters and operations chiefs".

Today's North Korean spies are the "second and third generation of those founding fathers of the North Korean intelligence community", Madden said.

But the use of foreign proxies such as the Vietnamese and Indonesian women suspected of carrying out the assassination of Kim Jong Nam is a break from typical North Korean operations.

In 1987, North Korean agent Kim Hyun Hee put a bomb on Korean Air Flight 858, killing all 115 people on board when it blew up over the Bay of Bengal.

Kim, who was caught and extradited to South Korea, was later pardoned and divulged the details of her military spy training in her 1993 memoir "Tears of my Soul".

Kim described being handed an ordinary-looking pack of Marlboro cigarettes when setting off on the mission. One cigarette was marked with a small black dab of ink which, if bitten, would kill her instantly, she wrote.

Kim was caught, but when she bit into the cigarette the cyanide inside failed to kill her.

"The faithful daughter of Kim Il Sung, trained for years like some obedient dog, died at that moment," Kim wrote in her memoir, referring to North Korea's founding president, who she said had given her handwritten orders to blow up the plane.

Kim Il Sung was the grandfather of the murdered Kim Jong Nam, and of current leader Kim Jong Un.