Every public record this site cites, linked so a reader can check what the
source said. Claims about named individuals come from these records;
entries published under the site’s own name record its own research.
Chollima HunterGitHub accounts credited with commits from The Raven File addresses (IT Worker Fraud), GitHub accounts credited with commits from tayvano...1297 pages cited
@browsercookiesSon Rim Song / Yuto Matsumori / Pinewood, Pak Jin Myong / EcomdevStar, Choe Gwang / Black Man, Kim Song Gyu / SeaStorm, Kim Thae Gwang / Araki Sato / James...110 posts cited
Hayden McKenzieAccount-Verification and Browser OTP Services on Corporate Assets, Persona-Management Tooling on an Employee Endpoint, spring day / RJM, VPS instances in a DPRK...104 pages cited
Chollima GroupNetKey and OConnect: DPRK Internal-Network Clients on an Endpoint, GitHub accounts credited with commits from Chollima Group addresses (IT Worker Fraud), North...4 pages cited
Kawaii Jong UwUn (@KawaiiJongUwUn)Liu Jian Hua / Kevin Crichton / Tom Love / Big Dream, Michael Liu Liang / Joseph Jackson / Michael Liang, Li Yin / Nakamura Suzuki / KingStone, Cheng Lin /...4 pages cited
Heiner GarcíaGitHub accounts and addresses in the Wagemole article (Heiner García), Onder Kayabasi, a fake blockchain recruiter (Heiner García), devmaster929...5 pages cited
bbsz (@blackbigswan)SonataM's copied memecoin sites (Ketman), CrazyDream000 and its renames (Ketman), jewelas and its collaborators (Ketman), GitHub accounts credited with commits...6 pages cited
OpenSourceMalwarePolinRider npm, Go and PHP compromises: command-and-control addresses, PolinRider npm, Go and PHP compromises: Tron wallets, NullReceiver: C2 Address Read from...21 pages cited
@zachxbt4K / Johnathon Teng / David Lepot / Clark Pickles / Kobayashi Kosuke / Zhang Xu / Roman Kholod / Hanh Dao / Shparuk Henadii / Robert Wang / Artem V / Oleksii...12 posts cited
The North Korean Infiltrator ThreatNetKey and OConnect: DPRK Internal-Network Clients on an Endpoint, GitHub accounts credited with commits from Flare addresses (IT Worker Fraud), North Korean...
Flare
2026-03-18
Direct observationsHuntsObservable indicatorsScraped indicators
123
ESETDeceptiveDevelopment Second-Stage Tooling: TsunamiKit, Tropidoor and AkdoorTea16 pages cited
@Narcass3Gerardo Salgado / Tammy Hans, DRC Team facilitation service, Accounts the researcher addressed to jeremymichael79 and Hakeohiratani, Seo Sigoto / Kiwon Seo /...23 posts cited
Security Alliance (SEAL)Camera off, or a face that does not match the profile, Recommends other candidates once hired, Accepts a rate well below market without negotiating, Output that...8 pages cited
Google Threat Intelligence GroupUnmanaged Remote-Access and RMM Tooling on Employee Endpoints, Inbound RDP and VNC Listeners on an Employee Endpoint, Astrill VPN Egress on Corporate...4 pages cited
U.S. Department of JusticeUS v. Virtual Currency Associated with North Korean IT Worker Money Laundering: seized addresses, US v. Virtual Currency Associated with North Korean IT Worker...18 pages cited
Direct observationsRepo scanner rulesetScraped indicators
74
MicrosoftIP-KVM Hardware on a Corporate Laptop and on Its Network Segment, Unmanaged Remote-Access and RMM Tooling on Employee Endpoints, Concurrent Multi-Geography...13 pages cited
Mees van Wickeren (Medium)DredSoftLabs, JSoft Labs and MetaMint Studio loader infrastructure (Mees van Wickeren), GitHub follow-and-star cluster (Mees van Wickeren)4 pages cited
NisosKarl Chong, Roman Kryveha, Ram Maharjan, John Alexander Bird, Saja network portfolio accounts (Nisos), A hardware KVM on the issued machine, A persona...5 pages cited
North Korean Malware, September 2025macOS Persistence and Staging Paths Used by Contagious Interview Payloads, BeaverTail to InvisibleFerret: The Contagious Interview Malware Chain, Suspicious...
U.S. Department of the TreasuryDo Phi Khanh, Hoang Minh Quang, Hoang Van Nguyen, Nguyen Quang Viet, Sim Hyon-Sop, York Louis Celestino Herrera, Yun Song Guk, Ho Jong Son, Jang Kuk Chol, U...18 pages cited
SekoiaClickFake Interview: ClickFix Execution and GolangGhost Persistence Site, macOS Persistence and Staging Paths Used by Contagious Interview Payloads2 pages cited
U.S. Federal Bureau of InvestigationCho Chung Pom, Choe Jong Yong, Hyon Chol Song, Jang Chol Myong, Jong Kyong Chol, Jong Song Hwa, Kim Mu Rim, Kim Ryu Song, Kim Ye Won, Ko Chung Sok, Ri Kyong...27 pages cited
HuntressIP-KVM Hardware on a Corporate Laptop and on Its Network Segment, IP-KVM Hardware Hiding Behind Spoofed USB Descriptors, Astrill VPN Egress on Corporate...5 pages cited
Rewards for Justice, U.S. Department of StateCho Chung Pom, Choe Jong Yong, Hyon Chol Song, Jang Chol Myong, Jong Kyong Chol, Jong Song Hwa, Kim Mu Rim, Kim Ryu Song, Kim Ye Won, Ko Chung Sok, Ri Kyong...3 pages cited
@banthisguy9349Konni infrastructure added in replies to Frost, Binance exploit of October 2026: Solana wallets, Qorexa Labs: second site with the same tank game, @fanboofy...6 posts cited
SANS Internet Storm CenterCross-platform npm stealer (SANS ISC, Xavier Mertens), IP-KVM Hardware on a Corporate Laptop and on Its Network Segment2 pages cited
Catching North Koreans & Laptop FarmsIP-KVM Hardware on a Corporate Laptop and on Its Network Segment, Inbound RDP and VNC Listeners on an Employee Endpoint
FBI Internet Crime Complaint CenterLaptop Shipping Address and Sign-In Geography Against the Record, Company Source Code Pushed to Personal Repositories from an Employee Endpoint, Fabricated...3 pages cited
Grumpy Goose LabsIP-KVM Hardware on a Corporate Laptop and on Its Network Segment, GL.iNet Comet IP-KVM Behind Its Built-In Obfuscation Profiles, A hardware KVM on the issued...3 pages cited
Ministry of Foreign Affairs, Republic of KoreaAn Kwang Il, Han Il Nam, Hwang Chol, Kang Hyon Chol, Kim Chol Min, Kim Kyong Il, Kim Ryu Song, Pak Hung Ryong, Pak Tong Hyon, Ri Il Jin, Ri Kum Hyong, Ri Yong...3 pages cited
No claim about a named individual is published without a public citation,
and each profile’s confidence level is taken from the cited
source’s own characterisation. The full rules are under
Sourcing and confidence.
Bulk datasets
Some sources publish an identifier list wholesale. Each is ingested under
one dataset-level citation, with the source’s own caveat below.
i3 Threat Advisory: Identifying North Korean IT Workers — Email IOCs Appendix
low confidenceIT Worker Fraud
A bulk list of email addresses DTEX's i3 threat intelligence team has observed associated with DPRK IT-worker operations, published as a public appendix so defenders can cross-check their own HR/recruitment records. Compiled by DTEX from third-party reporting connected to observed IT-worker operations.
1,080 entries
(3 excluded — 3 decoded value(s) from the source did not match a valid email format (e.g. a stray numeric suffix like '-13' appended in the source's own table cell) and were excluded rather than guessed at.)
· last synced 2026-10-26
(scheduled)
Dataset-specific caveat
Per DTEX's own advisory text: these IOCs are NOT indicative of a confirmed North-Korea-attributed hack — they may have associations with IT-worker operations and require further investigation if observed in your environment. Any connection to actual persons may be deliberate (an operator using a real person's identity) or incidental, and the actual owner of an email account listed here may be unaware their address is associated with this IOC list. Do not treat presence on this list as proof of wrongdoing by the account holder.
US v. Virtual Currency Associated with North Korean IT Worker Money Laundering: seized addresses
high confidenceIT Worker Fraud
Unhosted virtual-currency addresses seized under warrants 22-sz-6, 22-sz-13, 22-sz-18 and 22-sz-19, together with addresses whose stablecoin balances the issuer froze at law enforcement's request. Taken from Attachment A rather than from the body of the complaint: the body also names addresses in its narrative that are not part of the seized property, and the attachment is the bounded list the filing itself describes as complete.
39 entries
(3 excluded — Three addresses appear in the complaint narrative but not in Attachment A, and are not carried by this dataset, whose bound is the attachment. One of the three is nonetheless indexed, independently, from the scraper reading the complaint prose and quoting the sentence that names it; that is a separate provenance path with its own context rather than a contradiction of this bound. Entries are stored lowercased to match what the wallet normalizer emits, so a dataset entry and a scraped match of the same address resolve to one record instead of two.)
· last synced 2026-09-09
(manual)
Dataset-specific caveat
These are the addresses named in a civil forfeiture complaint as property the United States seized or had frozen, drawn from the complaint's Attachment A, which the filing introduces as listing in full every unhosted wallet address from which law enforcement seized funds in this investigation. A forfeiture complaint is an allegation against property rather than a conviction of any person: it states the government's case for why the funds are forfeitable, and the case had not been decided when this was recorded. Presence here says an address was seized or frozen in this action, not that any particular person has been found to have done anything.
US v. Virtual Currency Associated with North Korean IT Worker Money Laundering: seized ENS names
high confidenceIT Worker Fraud
ENS domain names seized alongside the addresses and NFTs taken under warrant 22-sz-13, listed in Attachment A under the June 2022 seized property.
Dataset-specific caveat
These are the addresses named in a civil forfeiture complaint as property the United States seized or had frozen, drawn from the complaint's Attachment A, which the filing introduces as listing in full every unhosted wallet address from which law enforcement seized funds in this investigation. A forfeiture complaint is an allegation against property rather than a conviction of any person: it states the government's case for why the funds are forfeitable, and the case had not been decided when this was recorded. Presence here says an address was seized or frozen in this action, not that any particular person has been found to have done anything.
PolinRider npm, Go and PHP compromises: command-and-control addresses
medium confidencePolinRiderContagious Interview
Addresses the report's indicator table gives for this wave: a primary command-and-control host, a stage-two loader, and two further hosts it says are shared with infrastructure already attributed to PolinRider.
Dataset-specific caveat
Third-party-reported, not independently verified by Chollima Hunter. The report marks two of these as novel to the incident it describes and the rest as already shared with PolinRider infrastructure, which is why most were already held here from other reporting; carrying them again records the corroboration rather than adding new claims. These are the attacker-side entries from the report's indicator table only. The 27 compromised packages and Go modules it also lists are the projects that were attacked, and naming those as indicators would name the victims.
PolinRider npm, Go and PHP compromises: Tron wallets
medium confidencePolinRiderContagious Interview
Tron addresses the report's indicator table lists for this wave, all three marked as shared with infrastructure already attributed to PolinRider. The campaign resolves its command-and-control location through chain transactions, which is why wallets appear in an infrastructure table rather than only as proceeds.
Dataset-specific caveat
Third-party-reported, not independently verified by Chollima Hunter. The report marks two of these as novel to the incident it describes and the rest as already shared with PolinRider infrastructure, which is why most were already held here from other reporting; carrying them again records the corroboration rather than adding new claims. These are the attacker-side entries from the report's indicator table only. The 27 compromised packages and Go modules it also lists are the projects that were attacked, and naming those as indicators would name the victims.
Astrill VPN exit addresses published by Spur
low confidenceIT Worker Fraud
IPv4 addresses Spur attributes to the Astrill VPN service, released free in December 2024 alongside its post on the service's use in DPRK remote-worker fraud. Spur, whose business is attributing anonymising infrastructure, published about 2,400 addresses it recorded as active on 19 December 2024 and said its customers were continuing to report fraudulent remote-worker applications arriving from them.
2,396 entries
(7 excluded — 7 line(s) in the source were not a single routable IPv4 host address (a .0 network address, a reserved range, or not an address at all) and were excluded rather than guessed at.)
· last synced 2026-10-26
(scheduled)
Dataset-specific caveat
These are the exit addresses of a commercial VPN service with customers everywhere. An address on this list says that a connection came through Astrill, which DPRK IT workers are documented to favour; it does not say who was behind the connection, and the great majority of traffic through these exits is ordinary customers. Treat a match as a reason to look at the account behind it, not as evidence about the person. The list is a snapshot of the addresses active on 19 December 2024; VPN exits are reassigned over time, so an address here may since have been returned to its hosting provider and given to someone else. The list is Spur's and is carried here as published.
Free proxy servers listed by IPRoyal
low confidenceIT Worker Fraud
IPv4 addresses of the free, public proxy servers IPRoyal lists on its site, as read on the sync date. Reporting on DPRK remote-worker cases in 2026 names IPRoyal beside Astrill VPN as a service the workers route through; carrying the public list lets a defender label a connection that came through one of these proxies.
5,440 entries
(728 excluded — 728 record(s) on the list were excluded because the index does not carry the address: CDN edge addresses (most of them Cloudflare's, shared by millions of sites), network or reserved addresses, public resolvers, or a value that is not a dotted IPv4 address with a valid port.)
· last synced 2026-10-26
(scheduled)
Dataset-specific caveat
This is IPRoyal's directory of free public proxies, not the company's paid residential network, and the servers on it belong to third parties and are used by anyone who finds the list. A match says that a connection came through a public proxy that IPRoyal listed on the day the list was read; it says nothing about who was behind it. Free proxies rotate within days, so the list is a snapshot that the weekly sync replaces, and an address here may since have gone back to ordinary use. Treat a match as a reason to look at the account behind it, never as evidence about the person.
NullReceiver: npm releases retrieving payloads through Ethereum transactions
medium confidenceNullReceiver
Releases Sonatype identified as malicious in its analysis of a technique that hides the command-and-control address inside an Ethereum transaction: the package reads the recipient of a zero-value transfer and decodes the server address from it, so the address can be rotated on-chain without republishing the package. Each entry is a specific published version, in name@version form.
Dataset-specific caveat
Third-party-reported, not independently verified per release by Chollima Hunter. These are version-pinned indicators on purpose: for a compromised legitimate package the name identifies the victim project rather than the threat, so a bare package name is not carried here, and the inclusion of a version says only that the cited report describes that release as malicious. Check the cited post before acting on any single entry.
PolinRider: malicious npm releases
medium confidencePolinRiderContagious Interview
Releases OpenSourceMalware inventoried as malicious in its PolinRider case study, where a maintainer account was used to ship BeaverTail through ordinary-looking package updates. The report notes that at the time of writing only one of these releases had been pulled from the registry. Each entry is a specific published version, in name@version form.
Dataset-specific caveat
Third-party-reported, not independently verified per release by Chollima Hunter. These are version-pinned indicators on purpose: for a compromised legitimate package the name identifies the victim project, not the threat, so a bare package name is not carried here and inclusion of a version says only that the cited report describes that release as malicious. Check the cited post before acting on any single entry.
ChainVeil and ViteVenom: malicious npm releases
medium confidencePolinRiderContagious Interview
Releases OpenSourceMalware attributes to the ChainVeil and ViteVenom clusters of the same campaign. Most are typosquats of build-tooling packages -- names one character or one word away from tailwind-merge, sass-format, rate-limiter-flexible and the Vite ecosystem -- published by the operator rather than injected into anyone else's project. Each entry is a specific published version, in name@version form.
Dataset-specific caveat
Third-party-reported, not independently verified per release by Chollima Hunter. These are version-pinned indicators on purpose: for a compromised legitimate package the name identifies the victim project, not the threat, so a bare package name is not carried here and inclusion of a version says only that the cited report describes that release as malicious. Check the cited post before acting on any single entry.
axios compromise: affected releases
medium confidenceAPT38
Releases of axios, and of the transitive dependency used to reach it, that OpenSourceMalware reports as carrying malicious code. axios is a legitimate package with roughly 100 million weekly downloads; these version numbers identify the compromised releases, and the package itself is the victim. Each entry is a specific published version, in name@version form. The report relays Google Threat Intelligence Group's attribution of the compromise to UNC1069 and Microsoft's to Sapphire Sleet, names this site files under the APT38 cluster; it does not tie the activity to Contagious Interview, so the releases carry the APT38 label here.
Dataset-specific caveat
Third-party-reported, not independently verified per release by Chollima Hunter. These are version-pinned indicators on purpose: for a compromised legitimate package the name identifies the victim project, not the threat, so a bare package name is not carried here and inclusion of a version says only that the cited report describes that release as malicious. Check the cited post before acting on any single entry.
axios attacker second wave: malicious npm releases
medium confidenceAPT38
Releases OpenSourceMalware attributes to the same operator in a follow-up wave after the axios compromise. The report cites Google Threat Intelligence Group and Microsoft attributions of the earlier activity to a DPRK-nexus actor. Each entry is a specific published version, in name@version form. The report relays Google Threat Intelligence Group's attribution of the compromise to UNC1069 and Microsoft's to Sapphire Sleet, names this site files under the APT38 cluster; it does not tie the activity to Contagious Interview, so the releases carry the APT38 label here.
Dataset-specific caveat
Third-party-reported, not independently verified per release by Chollima Hunter. These are version-pinned indicators on purpose: for a compromised legitimate package the name identifies the victim project, not the threat, so a bare package name is not carried here and inclusion of a version says only that the cited report describes that release as malicious. Check the cited post before acting on any single entry.
First-party research
A few indicators cite this site itself, under the publisher name Chollima
Hunter: values the maintainer read from a live account or listing on the
date recorded. Each is an observation, not an attribution; anyone who
believes one concerns their own identity can ask for review through the
submission page.
Reference material
Standing reference material, not cited for any claim on this site.
Reporting
A suspected DPRK IT worker, a malware-delivering interview or a
cryptocurrency theft is a matter for law enforcement. This site takes
indicators and corrections only, through its
submission page.
Covers Jiho Han, Chunji Jin, Haoran Xu and their manager, known as Zhonghua, for a scheme the program says used the identities of more than sixty real U.S. persons.
Rim Jong HyokRewards for Justice · 2024-07-25 · up to $10 million
For the Andariel operator charged over Maui ransomware attacks on U.S. hospitals; see the profile.
