RGB (Reconnaissance General Bureau)

This is not a behavioural cluster. The Reconnaissance General Bureau is North Korea's foreign intelligence organisation, and the tag records only that a source, such as an FBI wanted notice or U.S. charging document, places an individual inside it without naming a narrower group.

It is a strong attribution to a state organisation, made by a government that must defend it in court, but it says nothing about what the person did. Those carrying it were charged in unrelated operations.

Named individuals

5 profiled from law-enforcement records

Fabricated personas

438 reconstructed from reported accounts

Indicators

25,649 in the searchable index

Hunts

None in the hunt library

How it differs from the other clusters here

There is no RGB tradecraft to describe: the RGB is the employer, and every technique documented elsewhere sits under it.

Public reporting most often names Bureau 121; Mandiant's 2022 mapping assesses Lab 110 as its expanded form under the 3rd Bureau.

Mandiant assesses Lazarus Group, APT38 and Andariel as likely subordinate to it, though North Korea's command structure is opaque and unsettled.

The tag shows which individuals a government source places inside the state apparatus, as distinct from a vendor cluster name.

Compare Lazarus GroupAPT38KimsukyRemote Worker Fraud / Contagious InterviewAndarielAPT37KonniMoonstone SleetPolinRider

What a defender would see

Nothing here is hunted directly; follow the behavioural cluster a profile also carries.

Lazarus Group covers destructive and financial intrusions, Andariel ransomware-funded espionage, and Contagious Interview and IT-worker fraud the employment and fake-recruiter schemes.

An attribution to "the RGB" claims sponsorship, not tradecraft.

Every person below is named in a public charging document, sanctions record or law-enforcement wanted notice that carries this cluster tag. Each profile lists the records it draws on and nothing beyond them.

• Jon Chang Hyok전창혁
• Kim Il김일
• Park Jin Hyok박진혁
• Rim Jong Hyok림종혁
• Sim Hyon-Sop심현섭

Identities assembled from the accounts, addresses and portfolio sites reported under one name. A persona is a reporting artefact rather than a person: several may be run by one operator, and one may be run by several.

• 2401
• Adam Lee
• Aiden Mori
• Alerdi Jane
• Alex Hong
• Alex Wang

Indicators

The 25,649 indicators the index holds under this cluster. The complete index is on Remote Workers.

Show more results

Where the evidence comes from