Profiles and hunting guidance added or revised on Chollima Hunter, a public DPRK cyber threat-intelligence tracker. https://chollimahunter.github.io/ 2026-11-11T00:00:00Z Chollima Hunter https://chollimahunter.github.io/profiles/han-guo-bin/ 2026-11-11T00:00:00Z

Han Guo Bin is one of ten defendants the Justice Department lists with locations in China in a 14-defendant indictment charging wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft in a DPRK remote IT-worker scheme that affected more than 70 U.S. companies. The release does not set out Han Guo Bin's individual role, and none is asserted here. The release gives the location as Dandong City, China; it states that all defendants other than the two arrested in the United States remain at large. The confidence level of 'confirmed' reflects that this individual is named in a federal indictment returned on 1 October 2026 and unsealed on 13 October 2026 in the Northern District of Ohio (United States v. Ming, 1:26-cr-00429); the conduct is alleged, and every person named is presumed innocent unless and until proven guilty in a court of law.

https://chollimahunter.github.io/profiles/jin-long/ 2026-11-11T00:00:00Z

Jin Long is one of ten defendants the Justice Department lists with locations in China or an unknown location in a 14-defendant indictment charging wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft in a DPRK remote IT-worker scheme that affected more than 70 U.S. companies. The release does not set out Jin Long's individual role, and none is asserted here. The release gives the location as unknown and the age as 35; it states that all defendants other than the two arrested in the United States remain at large. The confidence level of 'confirmed' reflects that this individual is named in a federal indictment returned on 1 October 2026 and unsealed on 13 October 2026 in the Northern District of Ohio (United States v. Ming, 1:26-cr-00429); the conduct is alleged, and every person named is presumed innocent unless and until proven guilty in a court of law.

https://chollimahunter.github.io/profiles/juan-cecilio-pena-carrillo/ 2026-11-11T00:00:00Z

Juan Cecilio Pena Carrillo is a United States citizen, not a DPRK national, and is profiled here as a defendant charged as a domestic facilitator in a DPRK remote IT-worker scheme. The Justice Department names him, 37, of San Juan, Texas, among 14 defendants charged with wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft, and states that he had recently been arrested and was expected to make an initial appearance in the Northern District of Ohio. CyberScoop, reporting from the indictment, describes him as having hosted laptops at his home under various names and received about $190,000 from five employers; that description is the publication's and is cited to it. The confidence level of 'confirmed' reflects that this individual is named in a federal indictment returned on 1 October 2026 and unsealed on 13 October 2026 in the Northern District of Ohio (United States v. Ming, 1:26-cr-00429); the conduct is alleged, and every person named is presumed innocent unless and until proven guilty in a court of law.

https://chollimahunter.github.io/profiles/michael-james-bostelle/ 2026-11-11T00:00:00Z

Michael James Bostelle is a United States citizen, not a DPRK national, and is profiled here as a defendant charged as a domestic facilitator in a DPRK remote IT-worker scheme. The Justice Department names him, 31, of Philadelphia, Pennsylvania, among 14 defendants charged with wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft, and states that he had recently been arrested and was expected to make an initial appearance in the Northern District of Ohio. CyberScoop, reporting from the indictment, describes him as having provided his name and a fraudulent driver's license to help a remote worker get a job; that description is the publication's and is cited to it. The confidence level of 'confirmed' reflects that this individual is named in a federal indictment returned on 1 October 2026 and unsealed on 13 October 2026 in the Northern District of Ohio (United States v. Ming, 1:26-cr-00429); the conduct is alleged, and every person named is presumed innocent unless and until proven guilty in a court of law.

https://chollimahunter.github.io/profiles/pei-li-guang/ 2026-11-11T00:00:00Z

Pei Li Guang is one of ten defendants the Justice Department lists with locations in China in a 14-defendant indictment charging wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft in a DPRK remote IT-worker scheme that affected more than 70 U.S. companies. The release does not set out Pei Li Guang's individual role, and none is asserted here. The release gives the location as Liaoning, China; it states that all defendants other than the two arrested in the United States remain at large. The confidence level of 'confirmed' reflects that this individual is named in a federal indictment returned on 1 October 2026 and unsealed on 13 October 2026 in the Northern District of Ohio (United States v. Ming, 1:26-cr-00429); the conduct is alleged, and every person named is presumed innocent unless and until proven guilty in a court of law.

https://chollimahunter.github.io/profiles/sheng-zhang-kun/ 2026-11-11T00:00:00Z

Sheng Zhang Kun is one of ten defendants the Justice Department lists with locations in China in a 14-defendant indictment charging wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft in a DPRK remote IT-worker scheme that affected more than 70 U.S. companies. The release does not set out Sheng Zhang Kun's individual role, and none is asserted here. The release gives the location as Shenzhen, China; it states that all defendants other than the two arrested in the United States remain at large. The confidence level of 'confirmed' reflects that this individual is named in a federal indictment returned on 1 October 2026 and unsealed on 13 October 2026 in the Northern District of Ohio (United States v. Ming, 1:26-cr-00429); the conduct is alleged, and every person named is presumed innocent unless and until proven guilty in a court of law.

https://chollimahunter.github.io/profiles/sun-sheng-ming/ 2026-11-11T00:00:00Z

Sun Sheng Ming is one of ten defendants the Justice Department lists with locations in China in a 14-defendant indictment charging wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft in a DPRK remote IT-worker scheme that affected more than 70 U.S. companies. The release does not set out Sun Sheng Ming's individual role, and none is asserted here. The release gives the location as Dandong City, China and the age as 37; it states that all defendants other than the two arrested in the United States remain at large. The confidence level of 'confirmed' reflects that this individual is named in a federal indictment returned on 1 October 2026 and unsealed on 13 October 2026 in the Northern District of Ohio (United States v. Ming, 1:26-cr-00429); the conduct is alleged, and every person named is presumed innocent unless and until proven guilty in a court of law.

https://chollimahunter.github.io/profiles/wang-jian-jun/ 2026-11-11T00:00:00Z

Wang Jian Jun is one of ten defendants the Justice Department lists with locations in China in a 14-defendant indictment charging wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft in a DPRK remote IT-worker scheme that affected more than 70 U.S. companies. The release does not set out Wang Jian Jun's individual role, and none is asserted here. The release gives the location as Dandong City, China and the age as 34; it states that all defendants other than the two arrested in the United States remain at large. The confidence level of 'confirmed' reflects that this individual is named in a federal indictment returned on 1 October 2026 and unsealed on 13 October 2026 in the Northern District of Ohio (United States v. Ming, 1:26-cr-00429); the conduct is alleged, and every person named is presumed innocent unless and until proven guilty in a court of law.

https://chollimahunter.github.io/profiles/weng-shou-cheng/ 2026-11-11T00:00:00Z

Weng Shou Cheng is one of ten defendants the Justice Department lists with locations in China in a 14-defendant indictment charging wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft in a DPRK remote IT-worker scheme that affected more than 70 U.S. companies. The release does not set out Weng Shou Cheng's individual role, and none is asserted here. The release gives the location as Liaoning, China; it states that all defendants other than the two arrested in the United States remain at large. The confidence level of 'confirmed' reflects that this individual is named in a federal indictment returned on 1 October 2026 and unsealed on 13 October 2026 in the Northern District of Ohio (United States v. Ming, 1:26-cr-00429); the conduct is alleged, and every person named is presumed innocent unless and until proven guilty in a court of law.

https://chollimahunter.github.io/profiles/yu-yang/ 2026-11-11T00:00:00Z

Yu Yang is one of ten defendants the Justice Department lists with locations in China in a 14-defendant indictment charging wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft in a DPRK remote IT-worker scheme that affected more than 70 U.S. companies. The release does not set out Yu Yang's individual role, and none is asserted here. The release gives the location as Dandong City, China and the age as 40; it states that all defendants other than the two arrested in the United States remain at large. The confidence level of 'confirmed' reflects that this individual is named in a federal indictment returned on 1 October 2026 and unsealed on 13 October 2026 in the Northern District of Ohio (United States v. Ming, 1:26-cr-00429); the conduct is alleged, and every person named is presumed innocent unless and until proven guilty in a court of law.

https://chollimahunter.github.io/profiles/zhang-li-ping/ 2026-11-11T00:00:00Z

Zhang Li Ping is one of ten defendants the Justice Department lists with locations in China or an unknown location in a 14-defendant indictment charging wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft in a DPRK remote IT-worker scheme that affected more than 70 U.S. companies. The release does not set out Zhang Li Ping's individual role, and none is asserted here. The release gives the location as unknown; it states that all defendants other than the two arrested in the United States remain at large. The confidence level of 'confirmed' reflects that this individual is named in a federal indictment returned on 1 October 2026 and unsealed on 13 October 2026 in the Northern District of Ohio (United States v. Ming, 1:26-cr-00429); the conduct is alleged, and every person named is presumed innocent unless and until proven guilty in a court of law.

https://chollimahunter.github.io/profiles/zhang-wei-ping/ 2026-11-11T00:00:00Z

Zhang Wei Ping is one of ten defendants the Justice Department lists with locations in China in a 14-defendant indictment charging wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft in a DPRK remote IT-worker scheme that affected more than 70 U.S. companies. The release does not set out Zhang Wei Ping's individual role, and none is asserted here. The release gives the location as Dandong City, China; it states that all defendants other than the two arrested in the United States remain at large. The confidence level of 'confirmed' reflects that this individual is named in a federal indictment returned on 1 October 2026 and unsealed on 13 October 2026 in the Northern District of Ohio (United States v. Ming, 1:26-cr-00429); the conduct is alleged, and every person named is presumed innocent unless and until proven guilty in a court of law.

https://chollimahunter.github.io/hunts/ip-kvm-hardware-on-endpoint-and-network/ 2026-10-04T00:00:00Z

USB and PnP telemetry for the KVM-over-IP and video-capture hardware DPRK operators attach to employer-issued laptops, paired with the network view of the same devices: Raspberry Pi hardware addresses, the default TinyPilot host name and internet-exposed KVM interfaces.

https://chollimahunter.github.io/hunts/spoofed-ip-kvm-usb-descriptors/ 2026-10-04T00:00:00Z

Catches an IP-KVM whose vendor, product and serial strings have been renamed to something innocuous, using the USB configuration descriptor and interface shape the device cannot change without ceasing to work.

https://chollimahunter.github.io/hunts/glinet-comet-ip-kvm-fingerprints/ 2026-10-04T00:00:00Z

Fingerprints for the GL.iNet Comet, an IP-KVM whose firmware ships with ready-made presets that impersonate a Logitech, Corsair, Dell or Microsoft peripheral, and for the configuration descriptor, display identity and hardware address those presets leave untouched.

https://chollimahunter.github.io/hunts/rmm-remote-access-tool-sweep/ 2026-10-04T00:00:00Z

A fleet-wide sweep for the consumer remote-access and RMM software DPRK IT workers install to hand control of an employer-issued laptop to an operator overseas, with a per-device product count that flags the hosts running four or more of them.

https://chollimahunter.github.io/hunts/vs-code-dev-tunnel-abuse/ 2026-10-04T00:00:00Z

A developer laptop can be handed to a remote operator with no third-party software at all, using the tunnelling feature built into Visual Studio Code. ReliaQuest ranks it among the tools North Korean operators use most.

https://chollimahunter.github.io/hunts/rdp-vnc-listener-on-employee-endpoint/ 2026-10-04T00:00:00Z

A laptop-farm machine has to accept inbound connections. This looks for an endpoint listening on, or accepting traffic on, remote-desktop and remote-access ports, adapting the port checks published by mattysplo.it.

https://chollimahunter.github.io/hunts/astrill-vpn-egress/ 2026-10-04T00:00:00Z

Astrill VPN is the anonymisation service most consistently associated with DPRK remote-worker fraud. This matches corporate sign-ins against its published exit addresses.

https://chollimahunter.github.io/hunts/dprk-linked-isp-and-proxy-egress/ 2026-10-04T00:00:00Z

The addresses operators appear on when the VPN is not in the way: Russian TTK ranges around Khabarovsk, China Unicom, and the commercial proxy and hosting services named in recent casework.

https://chollimahunter.github.io/hunts/laptop-farm-shared-egress-address/ 2026-10-04T00:00:00Z

The signature of a laptop farm seen from the identity side: two or more employees who have nothing to do with each other, signing in from the same residential address.

https://chollimahunter.github.io/hunts/laptop-shipping-and-first-sign-in-geolocation-mismatch/ 2026-10-04T00:00:00Z

Joins HR, asset-shipping and identity-provider data to find new hires whose laptop shipped away from their recorded address, or whose first month of sign-ins geolocates away from it, the control Mandiant and the FBI single out.

https://chollimahunter.github.io/hunts/laptop-farm-concurrent-remote-access/ 2026-10-04T00:00:00Z

Impossible-travel and overlapping-session logic aimed at the specific case where a laptop physically sits in one country while the person operating it is in another.

https://chollimahunter.github.io/hunts/vdo-ninja-screen-and-webcam-relay/ 2026-10-04T00:00:00Z

Browser artifacts of the screen-relay and audio/video test services Huntress recovered from a suspected DPRK worker's laptop, including the vdo.ninja push URL used to stream the host's screen out.

https://chollimahunter.github.io/hunts/virtual-camera-and-video-call-obfuscation/ 2026-10-04T00:00:00Z

Software and hardware that lets an arbitrary video feed be presented to Zoom or Teams as a webcam, including real-time face-swap tooling, which is how an operator attends a call as somebody else.

https://chollimahunter.github.io/hunts/anti-idle-and-mouse-jiggler-tooling/ 2026-10-04T00:00:00Z

Software that keeps a machine awake and an account showing as present, which is what an operator running several jobs at once needs on every laptop they are not currently at.

https://chollimahunter.github.io/hunts/security-agent-tampering-on-employee-endpoint/ 2026-10-04T00:00:00Z

Disabling the SASE or endpoint agent is how an operator gets their own traffic out from under inspection. DTEX rates it low-recall but high-precision: it does not happen often, and when it does it means something.

https://chollimahunter.github.io/hunts/working-hour-and-session-length-anomalies/ 2026-10-04T00:00:00Z

Sustained sign-ins at times that make no sense for where the employee says they live, which is how an operator working several jobs round the clock shows in the identity logs. Excessive working hours is among the highest-rated indicators in DTEX's own casework.

https://chollimahunter.github.io/hunts/credential-notes-and-repository-reconnaissance/ 2026-10-04T00:00:00Z

Text files full of passwords in the obvious folders, which DTEX records in DPRK IT-worker casework as an operator's way of keeping credentials for several employers within reach.

https://chollimahunter.github.io/hunts/source-code-copied-to-personal-repositories/ 2026-10-04T00:00:00Z

Git pushes, remote changes and mirror clones aimed at accounts outside the organisation on public hosting services: the precursor to the data-extortion the FBI now attributes to discovered DPRK IT workers.

https://chollimahunter.github.io/hunts/dprk-it-worker-persona-and-portfolio-infrastructure/ 2026-10-04T00:00:00Z

A recruiting-side hunt: the free site builders that host fabricated candidate portfolios, the identity-reuse patterns across applications, and the profile tells that repeat across personas.

https://chollimahunter.github.io/hunts/dprk-it-worker-identity-payroll-fraud/ 2026-10-04T00:00:00Z

Shared bank details across employees who should have nothing in common, plus rapid post-hire direct-deposit changes, corroborated against sign-in geography.

https://chollimahunter.github.io/hunts/account-verification-and-browser-otp-services/ 2026-10-04T00:00:00Z

The services an operation uses to phone-verify accounts in bulk, hold VoIP numbers for personas, and generate multi-factor codes in a browser so a whole team can share one second factor.

https://chollimahunter.github.io/hunts/persona-management-tooling-on-employee-endpoint/ 2026-10-04T00:00:00Z

The tools an operation uses to keep many personas apart and to pass identity checks without a real phone or camera, anti-detect browsers, Android emulators and cookie-import tools among them, found on a machine that belongs to one supposed employee.

https://chollimahunter.github.io/hunts/contagious-interview-fake-recruiter-infrastructure/ 2026-10-04T00:00:00Z

Catches the interview lure itself: a candidate's workstation cloning and running an unvetted take-home repository, and traffic toward the front companies DPRK operators register to look like employers.

https://chollimahunter.github.io/hunts/clickfake-interview-clickfix-execution/ 2026-10-04T00:00:00Z

The lure where a fake interview site claims the candidate's camera driver is broken and has them paste a command into Run or Terminal, delivering GolangGhost or FrostyFerret.

https://chollimahunter.github.io/hunts/contagious-interview-macos-persistence-and-staging/ 2026-10-04T00:00:00Z

The launch agents, /var/tmp staging files, fake installer packages and abused developer signature that Contagious Interview's macOS payloads leave on a developer's Mac, from the FlexibleFerret, GolangGhost and BeaverTail installer lures.

https://chollimahunter.github.io/hunts/contagious-interview-beavertail-invisibleferret-chain/ 2026-10-04T00:00:00Z

The JavaScript stealer Contagious Interview delivers and the Python backdoor it installs, hunted as one chain: hidden .pyp, .npl and .n2 paths, the /pdown C2 layout, ports 1224, 3000 and 3306, silent AnyDesk and Telegram exfiltration.

https://chollimahunter.github.io/hunts/mirotalk-installer-masquerade-recruiter-lure/ 2026-10-04T00:00:00Z

A MiroTalk.msi or MiroTalk.dmg installer a job candidate is asked to run for a video interview, carrying the Qt-compiled BeaverTail Unit 42 documents, followed by the downloader fetching Python and InvisibleFerret from its controller on TCP 1224.

https://chollimahunter.github.io/hunts/etherhiding-jadesnow-on-chain-loader/ 2026-10-04T00:00:00Z

A script interpreter on a developer's machine reading blockchain explorer APIs to pull a smart-contract payload, then beaconing on TCP 3306: the on-chain loader Google Threat Intelligence Group attributes to UNC5342, the group behind Contagious Interview.