Chollima Hunter

A free, public index tracking North Korea's cyber operations.

• 28,594IndicatorsEmails, accounts, packages, wallets and repositories
• 438Fake personasInvented identities used to apply for jobs
• 106Named individualsPeople named in indictments, wanted notices and sanctions
• 351Sources350 published reports and posts, and 1 of this site’s own records

What's a Chollima?

1. 천cheona thousand
2. 리ria Korean unit of distance, about 0.4 km (a quarter mile)
3. 마mahorse

How the scheme works

1. 1

   Build a fake developer

   A stolen or AI-made photo, an invented CV, and GitHub and LinkedIn accounts to match.

2. 2

   Get hired remotely

   Pass the interviews, often with help from people abroad who receive the work laptop and keep it online.

3. 3

   Send it home

   The salary goes to the regime. The access can be used to steal code, data or crypto.

It also runs the other way: fake recruiters send real developers a "coding test" that installs malware. Researchers call that Contagious Interview.

Use it

• Search the indexCheck an applicant's email, GitHub or LinkedIn against everything reported.
• Spot the red flagsWhat a fake candidate looks like, from CV to interview.
• Hunt in your networkReady-to-run queries for the tools these operators leave behind.
• Scan your codeFind the malicious packages and repositories in your dependencies.

Who's behind it

Not freelance criminals. A state program, run by three arms of the North Korean government.

Mapping per Sekoia (September 2026), which records the agencies' 2026 names. North Korea reorganises these units often, and researchers disagree on where some groups sit; where a profile names a unit, its own citation is the authority.

Meet the groups

Each one opens its own page: what it does, what a defender would see, and the research worth reading.

• Lazarus Group3 profiles2,718 indicatorsA broad, long-running DPRK intrusion cluster active since at least the early 2010s, spanning financial theft, destructive attacks, and espionage. Often used as an umbrella label for RGB-linked activity that doesn't fit a narrower named cluster.
• APT38No profiles yet810 indicatorsA financially motivated DPRK cluster focused on large-scale bank heists and fraudulent SWIFT transactions — distinct in tradecraft from more espionage-focused clusters despite overlapping RGB attribution.
• KimsukyNo profiles yet1,944 indicatorsA DPRK cluster focused on intelligence collection: phishing and social-engineering campaigns aimed at government, academic, and think-tank targets, particularly around Korean Peninsula policy topics.
• RGB (Reconnaissance General Bureau)5 profiles25,022 indicatorsUsed as a profile tag when the citing source (e.g. a DOJ indictment) attributes an individual directly to the RGB without a more specific named sub-cluster.
• Remote Worker Fraud / Contagious Interview101 profiles19,966 indicatorsDPRK-linked fraudulent IT-worker and fake-recruiter schemes: fraudulent remote-developer employment and fake job-interview malware delivery ("Contagious Interview").
• Andariel1 profile183 indicatorsA DPRK cluster the FBI identifies as a unit of the Reconnaissance General Bureau, named in U.S. charging documents over ransomware intrusions against healthcare and defence targets — distinct from the financially-motivated bank-heist activity tracked under APT38.
• APT37No profiles yet598 indicatorsA DPRK espionage cluster working against South Korean targets and the diaspora around them, distinguished by a long-running custom implant, RokRAT, and by delivery that leans on shortcut files and document formats specific to the Korean desktop.
• KonniNo profiles yet529 indicatorsA DPRK cluster named for the malware family it runs, reported alongside Kimsuky often enough that several vendors treat the two as one and others keep them apart; this site indexes it under its own label and says so where a source disagrees.
• Moonstone SleetNo profiles yet115 indicatorsA DPRK cluster that stands up whole fake software companies rather than only fake employees, and the only one on this site reported to have run its own ransomware against a target it had already been paid by.
• PolinRiderNo profiles yet151 indicatorsA DPRK/Lazarus-attributed campaign, documented by OpenSourceMalware, that injects malicious code into config files inside compromised legitimate GitHub repositories rather than through a fake-interview lure — reported as operationally merged with the Contagious Interview cluster.

All profiles

• Chang Nam Il장남일
• Cho Chung Pom조충범
• Choe Jong Yong최정용
• Choe Song Ryong최성룡
• Hyon Chol Song현철성
• Jang Chol Myong장철명
• Jin Sung-Il진성일
• Jon Chang Hyok전창혁
• Jong Kyong Chol정경철
• Jong Pong Ju정봉주
• Jong Song Hwa정성화
• Kang Kil Nam강길남
• Kang Tae Bok강태복
• Kim Il김일
• Kim Kum Song김금성
• Kim Kwang Jin김광진
• Kim Mu Rim김무림
• Kim Ryu Song김류성
• Kim Se Un김세운
• Kim Won Jin김원진
• Kim Ye Won김예원
• Ko Chung Sok고충석
• Ko Song Guk고성국
• Myong Chol Min명철민
• Pak Hyon Song박현성
• Pak Jin-Song박진송
• Park Jin Hyok박진혁
• Ri Hyon Su리현수
• Ri Kwang Il리광일
• Ri Kwang Rim리광림
• Ri Kyong Sik리경식
• Rim Jong Hyok림종혁
• Rim Un Chol림은철
• Sim Hyon-Sop심현섭
• Sok Kwang Hyok석광혁
• Son Un Chol손은철
• Christina Marie Chapman
• Huang Jingbin
• Liu Enchia
• Liu Menting
• Tong Yuze
• Xu Yongzhe
• Yuan Ziyou
• Zhou Baoyu
• Zhou Zhenbang
• No photographAn Kwang Il안광일
• No photographHan Il Nam한일남
• No photographHo Jong Son허정선
• No photographHwang Chol황철
• No photographJang Kuk Chol장국철
• No photographJo Kyong Hun조경훈
• No photographJon Yon Gun전연근
• No photographJong In Chol정인철
• No photographKang Hyon Chol강현철
• No photographKim Chol Min김철민
• No photographKim Hyo Dong김효동
• No photographKim Ki Hyok김기혁
• No photographKim Kyong Il김경일
• No photographKim Sang Man김상만
• No photographKim Song Il김성일
• No photographKim Ung Sun김응순
• No photographPak Hung Ryong박흥룡
• No photographPak Tong Hyon박동현
• No photographRi Il Jin리일진
• No photographRi Kum Hyong리금형
• No photographRi Yong Rim리영림
• No photographSin Jong Ho신정호
• No photographSon Kyong Sik송경식
• No photographSong Kum Hyok송금혁
• No photographSong Min Kim김성민
• No photographSung Chol Bom승철범
• No photographU Yong Su우영수
• No photographYu Song Hyok유성혁
• No photographYun Jong Sik윤정식
• No photographYun Song Guk윤성국
• No photographYun Song Il윤성일
• No photographAlexander Paul Travis
• No photographAudricus Phagnasay
• No photographDo Phi Khanh
• No photographEmanuel Ashtor
• No photographErick Ntekereze Prince
• No photographGayk Asatryan
• No photographHan Guo Bin
• No photographHoang Minh Quang
• No photographHoang Van Nguyen
• No photographJason Salazar
• No photographJin Long
• No photographJuan Cecilio Pena Carrillo
• No photographKejia Wang
• No photographMatthew Isaac Knoot
• No photographMichael James Bostelle
• No photographMinh Phuong Ngoc Vong
• No photographNguyen Quang Viet
• No photographOleksandr Didenko
• No photographPedro Ernesto Alonso De Los Reyes
• No photographPei Li Guang
• No photographSheng Zhang Kun
• No photographSun Sheng Ming
• No photographVitaliy Sergeyevich Andreyev
• No photographWang Jian Jun
• No photographWeng Shou Cheng
• No photographYork Louis Celestino Herrera
• No photographYu Yang
• No photographZhang Li Ping
• No photographZhang Wei Ping
• No photographZhenxing Wang

Show the remaining profiles