Glossary
Reporting on DPRK cyber operations uses several overlapping vocabularies at once: the names vendors assign to clusters, the names campaigns and malware families acquire, and the organisational terms from government records. This page defines the ones that appear across this site. Each definition is drawn from the cited source, and the cluster pages carry the full alias list for each actor. The labels this site puts on its badges are defined at the end.
-
Chollima
The winged horse of Korean legend, adopted by the DPRK as a national symbol of speed and effort. CrowdStrike uses it as the animal suffix for every adversary it attributes to North Korea, which is why names such as Famous Chollima, Labyrinth Chollima and Stardust Chollima recur across vendor reporting. This site takes its name from that convention.
-
Sleet
The weather-themed suffix Microsoft assigns to threat actors it attributes to North Korea, in the same way it uses Typhoon for China and Blizzard for Russia. Diamond Sleet, Sapphire Sleet, Emerald Sleet, Onyx Sleet, Jasper Sleet, Citrine Sleet and Moonstone Sleet are all DPRK-attributed clusters under this scheme.
-
Pisces
The constellation Palo Alto Networks Unit 42 assigns to threat groups it attributes to North Korea, paired with a modifier word to distinguish clusters within it — the same scheme that gives China Taurus and Russia Ursa. Gleaming Pisces, Slow Pisces, Jumpy Pisces, Alluring Pisces and Sparkling Pisces are all DPRK-attributed clusters this site cross-references against other vendors' names.
-
UNC and APT designations
Mandiant's numbering for the clusters it tracks. A UNC ("uncategorized") number labels intrusion activity not yet classified further, and may later graduate into an APTn (nation-state) or FINn (financially motivated) group. UNC1069, UNC4736 and UNC4899 are cited as the report names them.
-
Reconnaissance General Bureau (RGB)
North Korea's principal foreign intelligence agency, which the U.S. Treasury identifies as the body chiefly responsible for the country's cyber operations through its subordinate units. Most of the clusters on this site are described in their citations as sitting under the RGB in some form.
-
Lab 110 and Bureau 121
Cyber units named in U.S. reporting as parts of the RGB. Bureau 121 was long reported as North Korea's primary hacking unit; Mandiant's 2022 mapping assesses Lab 110 as its expanded form under the 3rd Bureau. A profile's citation is the authority for any claim.
-
Contagious Interview
A campaign in which DPRK operators pose as recruiters and steer software developers into a fake interview process that ends with the candidate running malware, typically a trojanized coding assignment or a bogus video-call fix. Named by Palo Alto Networks Unit 42, which reported it alongside Wagemole.
-
Wagemole
Unit 42's name for the other half of the same activity: DPRK operatives using fabricated identities to obtain remote IT jobs at foreign companies and route the salaries back to the regime. The personas and identifiers indexed on this site's Remote Workers pages are the residue of this campaign.
-
BeaverTail
A JavaScript downloader and information stealer delivered through trojanized applications and npm packages in Contagious Interview lures. It harvests browser data and cryptocurrency-wallet extensions and stages the follow-on payload, usually InvisibleFerret.
-
InvisibleFerret
A cross-platform Python backdoor typically dropped by BeaverTail, giving the operator remote control of the developer's machine along with keylogging and credential theft.
-
ClickFake Interview and GolangGhost
A 2025 evolution of Contagious Interview aimed at cryptocurrency-industry staff, in which a fake interview site shows a bogus camera or microphone error and instructs the target to paste a fix into a terminal. The command installs GolangGhost, a Go backdoor.
-
WeaselStore
ESET's name for a cross-platform Go information stealer and backdoor used in the same fake-interview lures, overlapping with what other vendors track as GolangGhost and FlexibleFerret. ESET tracks the wider campaign as DeceptiveDevelopment.
-
Laptop farm
A residence or office, usually in the United States, where a paid facilitator keeps the company-issued laptops of remote employees who are in fact DPRK IT workers abroad. The workers reach the machines over remote-access software or KVM-over-IP hardware so their traffic appears to come from a domestic address.
-
IP-KVM
A small device that plugs into a laptop's HDMI and USB ports and exposes its screen, keyboard and mouse over the network, so a distant operator controls the machine below the operating system without installing remote-access software the employer could detect. The hardware hunts on this site look for the USB descriptors and network presence these devices leave behind.
-
Freelance account fraud
The practice of renting, buying or fabricating accounts on freelance marketplaces so that a DPRK worker can bid for contract work behind the verified identity of someone else, often a person in the same country as the client.
-
Famous Chollima
CrowdStrike's name for the North Korea-nexus adversary behind the fraudulent freelance and full-time IT employment schemes, which it also links to the BeaverTail and InvisibleFerret malware.
-
Moonstone Sleet
A North Korean actor Microsoft described in 2024 as blending espionage with revenue generation: fake software companies, trojanized tools, a custom ransomware family, and job-seeking approaches that overlap with the IT-worker schemes.
-
Operation In(ter)ception and Operation Dream Job
The names ESET and ClearSky gave in 2020 to a Lazarus-linked espionage campaign that approached aerospace and defence employees through fake recruiter profiles on LinkedIn and delivered malware inside job documents. The recruiter lure that Contagious Interview later turned on software developers was refined here.
-
TraderTraitor
The U.S. government's name for a set of trojanized cryptocurrency-trading applications, distributed to exchange and finance staff, that a North Korean state group used to steal cryptocurrency. Later reporting applies the name to the cluster itself.
-
AppleJeus
A family of trojanized cryptocurrency-trading applications that Lazarus Group has distributed since at least 2018, each a working trading client with a backdoor inside, used to steal cryptocurrency from individuals and companies.
-
EtherHiding
Storing a malicious payload inside a smart contract on a public blockchain so that compromised websites fetch it from the chain rather than from a server that can be taken down. Google Threat Intelligence Group reported DPRK-linked UNC5342 using it in 2025, the first nation-state use it had seen.
-
DPRK RevGen: Domestic Enabler Initiative
A U.S. Department of Justice effort, led by its National Security Division with the FBI, to identify and prosecute the people and businesses inside the United States that enable North Korean revenue generation, including the facilitators who run laptop farms for IT workers.
-
Mixers and OTC laundering
Stolen cryptocurrency is moved through mixing services that pool and redistribute funds to break the on-chain trail, then converted to cash through over-the-counter traders. OFAC's designation of the mixer Sinbad describes it as a key laundering tool for Lazarus Group proceeds from the Horizon Bridge and Axie Infinity thefts.
Labels used on this site
What each badge on the site means, what was checked to set it, and where it appears.
Confidence levels
A confidence badge means something slightly different depending on what it is attached to. On a named individual's profile it is the cited source's characterisation; elsewhere it is set out below.
-
Confirmed
The highest confidence level on a named individual's profile, used only when a government record names the person: a charging document, wanted notice, plea, conviction, or sanctions designation. It is not a finding by this site; a person charged is presumed innocent.
-
High, medium and low on a profile
On a named individual's profile, a level below confirmed reflects how the cited source itself characterises the attribution. The site neither raises nor lowers it: a source that states moderate confidence produces a medium entry, whatever the site's own view.
-
Confidence on a hunt
A hunt's HIGH, MEDIUM or LOW CONFIDENCE badge describes the hunt, not a person: how closely a match on it points to the activity its sources describe. Behaviour that is common in ordinary environments, such as mouse-jiggling software, keeps a hunt low however strong its sources are. Each hunt's false-positive notes say what else triggers it.
-
Confidence on a bulk dataset
One level applies to every entry in a list ingested wholesale, reflecting the source's own caveats. A list of shared VPN exit addresses is low, because a match is a reason to look at the account, not evidence about a person.
-
Confidence on an EtherHiding entry
Each entry on the EtherHiding watchlist carries the level its cited source gives to the connection between that contract, address or detection string and the campaign.
-
Confidence on a candidate profile
On Potential DPRK Profiles, this site's own assessment of the screening signals a profile matches, such as a VoIP number, CV text shared with another listing, or an account under a different name. High requires several signals, one strong. It measures a pattern match only.
Provenance labels
Every indicator carries one label saying how the value reached the index. Where several sources hold the same value, the label comes from the first route in this order: the hand-curated ruleset and watchlist; researchers' posts, registries and the site's own observations; scraped reports; bulk lists; and candidates under review. Every source is still cited.
-
CURATED
Entered by hand: a repository-scan ruleset or EtherHiding watchlist entry cited to its source, or a value read directly from a live account or listing, cited to the page and date. Such an observation states what the account showed that day, not who operates it.
-
MATCHED IN SOURCE
Found by the site's scraper as a literal match in the text of the cited report, with the surrounding passage kept as a quote. The value appears in the source exactly as indexed; the quote shows what the source says about it.
-
AI-EXTRACTED
Asserted by a language model reading the cited report, rather than matched literally in its text. Where the value could not then be found in the source, the entry says that it was not verified against its source.
-
RESEARCHER POST
Transcribed by hand from a named researcher's public post, usually on X. A person stands behind the value, but there is no published methodology to check it against.
-
THIRD-PARTY REGISTRY
Taken from a standing registry that publishes identities and their identifiers persona by persona. The registry made the attribution, not this site, and it has no byline or methodology to check.
-
BULK DATASET
One entry in a list a source published wholesale, such as a report appendix, ingested under a single citation for the whole list. The source did not discuss the entry individually, and the dataset's own caveat applies to it. The same label is shown for a record whose route into the index is not otherwise recorded.
-
UNDER REVIEW
A value from a profile on Potential DPRK Profiles that a reviewer has opened and rated medium or high on the site's own screening signals. It is not confirmed. It ranks below every other route, so a value that any source also reports carries that source's label instead.
Status labels
A status records the result of a check made on a stated date, shown beside it. It is true as of that date only. Accounts are deleted and re-registered, packages are pulled and republished, and addresses change hands, so every status goes stale from the day it is taken.
-
LIVE and REMOVED
Whether an account still existed at the address the source gave when last checked. GitHub is read directly, LinkedIn checked by hand, and other platforms only where a missing profile is reported honestly. LIVE says nothing about who operates the account.
-
RECYCLED
A GitHub login that now belongs to a different account from the one reported: the original was deleted and the name was registered again after the identifier was published. The present holder is unconnected to the entry, and no picture or detail of it is shown.
-
LIVE MALWARE and TAKEN DOWN
For a malicious repository or an npm or PyPI package. LIVE MALWARE means it could still be fetched when last checked; TAKEN DOWN means it had been removed from the platform. Both are set by scripts/enrich-malware-status.js.
-
Network kinds
The kind of network an IP address sits on: a named VPN (on Spur's published list), proxy or VPN, data centre, mobile carrier, fixed line (an ordinary subscriber range) or unresolved. The country shown is where the range is registered, not where any person was.
-
Line types
For a telephone number, the kind of line a lookup returned: VoIP, wireless, landline or not assigned. On Potential DPRK Profiles, NO MATCH means nothing came back, Not checked means no lookup was run, and N/A means no number was published.
-
Photograph checks
On Potential DPRK Profiles, what the account's picture turned out to be. AI and CAMERA record a detector's score for a generated or photographed face; FACE, UNSCORED awaits a detector; the other labels had no face to score. A score is not a finding.
-
UNDER REVIEW and CONFIRMED on a candidate
The review state of a row on Potential DPRK Profiles. UNDER REVIEW means a reviewer found it worth continued attention but not enough to state a DPRK connection. CONFIRMED means independent corroboration, such as a cited report, shared indicator, or password or infrastructure link.
-
Detection or research repository
On the Repo Scanner's match table, a match inside a repository that appears to publish detection rules or an indicator list on purpose, such as a YARA ruleset or a cleanup scanner, which is the opposite of a compromised project. The tag is a heuristic on the matched file path and repository name, not a verified classification.
Other labels
-
P1, P2 and P3
The priority of a pattern in the red-flags register. P1 is hard to explain innocently and warrants escalation on its own. P2 is strong: investigate, and look for a second signal. P3 is common on its own and counts only alongside others.
-
IOC Hunt, TTP Hunt and Behavioral Hunt
The kind of detection a hunt performs. An IOC hunt matches specific values a report published, such as addresses, domains, hashes or package names. A TTP hunt matches the behaviour, tooling or artefacts of a technique whatever the specific values. A behavioural hunt is statistical, looking for a pattern across sessions or records rather than any single event.