PC-1234 (central hub machine - routes payment confirmations from 390+ accounts) - RB Wallet (Korea Ryonbong General Corp ⚠️ OFAC SDN) - $2.84M+ · Click to expand/collapse · Hover for intelligence details
This chart depicts a single observed cluster - a snapshot in time, and likely one of many parallel operations of similar scale and structure currently active.
Published by DTEX Threat Intelligence. This chart is linked from the DTEX blog post covering DPRK IT worker operations in depth. On-chain research credit: ZachXBT.
Note: Some organizational names, operator identifiers, and quoted communications appear in Korean (한국어) and Japanese, transliterated from intercepted source material. Translations are provided inline where available.
| IP Address | Role | Known Routes / Details | Source |
|---|---|---|---|
192.168.109.2 |
NetKey Authentication Server | /login · /machine_info · /machine_info_new · /paymentCha Gang Song (KUT) registered here 2023-04-29, ID 42-cgs1104, license 8EB6-6464-B1B6-498F-CC9A. OConnect + ipmsg.exe distributed from this subnet. Raw chat IPs confirm senders on this LAN. |
🟢 Confirmed |
192.168.109.3 |
NetKey installer host | Hosts netkey_lux binary |
🟢 Confirmed |
192.168.109.156 |
OConnect LAN node | OConnect software endpoint on local network | 🟢 Confirmed |
192.168.109.250 |
Separate DPRK service | Unknown service on same subnet | 🟢 Confirmed |
Operators use Western, Japanese, Eastern European, and Central Asian cover identities to access freelance platforms and receive payments. Source column indicates whether the identity was recovered from raw internal communications (Raw Chat) or external records such as payment ledgers, network captures, or breach data (External).
All payments from 390+ operator accounts route through PC-1234 (RB Wallet / Korea Ryonbong General Corp). The following Payoneer accounts were registered to this hub and identified in payment platform data.
| Account | Cover Name / Notes | Source | Evidence |
|---|---|---|---|
| [email protected] | Cover names: "Muhammad Junaid" / "Lupi Blame" - central hub Payoneer account | External | 🟢 Confirmed |
| [email protected] | PC-1234 Payoneer account | External | 🟢 Confirmed |
| [email protected] | PC-1234 Payoneer account | External | 🟢 Confirmed |
| [email protected] | PC-1234 Payoneer account | External | 🟢 Confirmed |
| [email protected] | PC-1234 Payoneer account | External | 🟢 Confirmed |
| [email protected] | PC-1234 Payoneer account | External | 🟢 Confirmed |
| Cover Identity / Handle | Linked Operator / Unit | Cover Type | Notes | Source | Evidence |
|---|---|---|---|---|---|
| [email protected] | kh430 / Industry 2 | Gmail - Western female name cover | - | Raw Chat | 🟢 External information |
| [email protected] | ri_cholho / CIC Team, Base 5 | Outlook - Polish male name cover | Payoneer-registered. Used to receive payments from CIC team. | Raw Chat | 🟢 External information |
| [email protected] | ChongJin-Industry2 | Gmail - Ukrainian male name cover · Payoneer | GitHub: github.com/voleks3d (3D developer profile) | External | 🟢 External information (Payoneer) |
| ihor_zhuravskyi (alias) | Ryang Gang / RS Committee | Ukrainian-sounding cover alias | Eastern European cover consistent with confirmed DPRK pattern. | Raw Chat | 🟢 External information |
| admiral9200 | admiral / Base 5 (assessed) | GitHub developer handle - possible cover account | Association to 'admiral' operator assessed, not confirmed. Pending stronger corroboration. | External | 🟡 Assessed |
Group 12 identities sourced from internal DPRK documentation (January 2024 payment ledger and cover credential records) - classified as External. Group 5 (kut-five) identities sourced from IP Messenger log headers on the 192.168.142.x LAN segment - classified as External. Notes contain cover identity (Group 12) or machine hostname / IP / hardware hash (Group 5).
Credential cluster note: Multiple Outlook and GitHub accounts share a common credential root (kutgs1120) - satellite/space-themed naming pattern. Accounts: [email protected], [email protected], [email protected], [email protected], [email protected]. GitHub: kutgs1491625.
| Handle / NetKey | Group | Real Name | Notes | Source | Evidence |
|---|---|---|---|---|---|
| GROUP 12 - Internal DPRK documentation, January 2024 | |||||
@12-CGS (cgs1104) | Group 12 | Cha Gang Song | NetKey ID 42-cgs1104 · Machine reg. 2023-04-29 · Payoneer (Unity) | External | 🟢 Confirmed |
@12-pmh | Group 12 | Paek Myong Ho | Cover: "Yamahiro" ([email protected]) · Crowdworks Japan · Payoneer (Unity) | External | 🟢 Confirmed |
@12-kms | Group 12 | Kim Mun Song | Cover: "Masato" ([email protected]) · Payoneer (Unity) | External | 🟢 Confirmed |
@12-lsr | Group 12 | Li Song Ryong | Payoneer (Unity) | External | 🟢 Confirmed |
@12-pch | Group 12 | Paek Choe Hyon | Cover: "Shoxrux Boymaxmatov" · National Bank of Uzbekistan (account number redacted) · Payoneer (Unity) | External | 🟢 Confirmed |
@12-psi | Group 12 | Pyo Se Il | Cover: "Hirose Ibuki" ([email protected]) · Lancers.jp Japan · Payoneer (Unity) | External | 🟢 Confirmed |
@12-jms | Group 12 | Jang Myong Song | Cover: "Erkin Xabibulloyev" ([email protected]) · DOB 1991-09-19 · National Bank of Uzbekistan (account number redacted) · Payoneer (Unity) | External | 🟢 Confirmed |
| GROUP 5 - kut-five LAN segment (192.168.142.x), IP Messenger log headers | |||||
| Blake | Group 5 | - | DESKTOP-4GUBGIN / 192.168.142.99 / Blake-<647facb4d244de5f> | External | 🟢 Confirmed |
| Cleaner | Group 5 | - | DESKTOP-HL0GO5F / 192.168.142.103 / JIH-<56e2ec2e4feca25f> | External | 🟢 Confirmed |
| Butterfly | Group 5 | - | DESKTOP-TPA5138 / 192.168.142.110 / a-<d8835e8b12f65829> | External | 🟢 Confirmed |
| !John Doe! | Group 5 | - | SPACEMAN / 192.168.142.83 / HANDSOME-<e4eed35e9ef3bb3a> | External | 🟢 Confirmed |
| taeng! | Group 5 | - | DESKTOP-VPNEDAR / 192.168.142.87 / Admin-<6914ecf5cf6f6f56> | External | 🟢 Confirmed |
| Bark | Group 5 | - | DESKTOP-A79PPVE / 192.168.142.106 / BarK-<41e20f5340731d15> | External | 🟢 Confirmed |
| BA | Group 5 | - | DESKTOP-BPP4MNJ / 192.168.142.101 / PC-<c79f7966f94b41c2> | External | 🟢 Confirmed |
| Raised Dragon | Group 5 | - | DESKTOP-FGELVK1 / 192.168.142.94 / Kolin An-<b2b426a2a742c204> | External | 🟢 Confirmed |
| Kei | Group 5 | - | TOP-PC / 192.168.142.89 / TOP-<a2157f660c206f09> | External | 🟢 Confirmed |
| Naokee | Group 5 | - | OOSAKA / 192.168.142.112 / kkk-<028ffedcb8a0416b> | External | 🟢 Confirmed |
| Richard | Group 5 | - | DESKTOP-2CJGE8E / 192.168.142.82 / 1-<5b489be37f8a4bfc> | External | 🟢 Confirmed |
| Cris | Group 5 | - | DESKTOP-OA4JLBM / 192.168.142.115 / 1-<2fe7551af5f158c0> | External | 🟢 Confirmed |
| David Smith | Group 5 | - | DESKTOP-3R567FQ / 192.168.142.84 / Astro-<105344548c8c8805> | External | 🟢 Confirmed |
| Roper | Group 5 | - | CKS-LEIX / 192.168.142.96 / 1-<dad1278254437a13> | External | 🟢 Confirmed |
| angelesjackson | Group 5 | - | DESKTOP-93JVUH4 / 192.168.142.108 / yyy-<cefb7a90f7443f39> | External | 🟢 Confirmed |
| jenny | Group 5 | - | DESKTOP-B8U4DOU / 192.168.142.91 / a-<bc4afe171388c758> | External | 🟢 Confirmed |
| Entity | Status | Legal Basis | Connection to Network |
|---|---|---|---|
| Korea Ryonbong General Corporation (RB Wallet / PC-1234) | ⚠️ OFAC SDN + UN SC 1718 | EO 13382 · UN SC Res.1718 (Apr 2009) | Central payment hub. ALL $2.84M+ flows through its wallet. Platform self-labeled "RB Wallet." 5 independent hits in existing holdings confirming identity. |
| 313 Munitions Industry Dept, WPK (Base 3) | ⚠️ OFAC SDN + UN | Multiple OFAC actions · UN designation | Platform explicitly labels Base 3 as "Unit 313 / PN_313." Three designated front companies in raw chats. |
| Korea Songkwang Trading General Corp (SonKwang Trading Co.) | ⚠️ OFAC SDN | EO 13810 | Self-identified in chat as "SonKwang Trading company in Coal ministry." 30 IT workers dispatched to Russia via 10-yr contract 2024. |
| Korea Sobaeksu Trading Company (313 MID front co.) | ⚠️ OFAC SDN | Jul 2025 designation | 313 MID front company. Unit name "Sobaeksu" appears 4× in raw chats as a paying unit. |
| Korea Saenal Trading Corporation (313 MID front co.) | ⚠️ OFAC SDN | IT worker dispatch actions | 313 MID front company. Self-ID in chats: "I am from Saenal. I sent 700 to RB." 2 appearances. |
All organizational entities appearing in the chart above, excluding individual operator handles. For detailed intelligence including verbatim quotes, hover on the node in the chart. Entities are grouped by their chart position. Confidence: HIGH / MEDIUM / LOW.
| Entity | Type | Location / Province | Key Context | OFAC | Conf |
|---|---|---|---|---|---|
| CENTRAL HUB | |||||
| PC-1234 / RB WALLET | Payment Hub | DPRK (via VPN) | Korea Ryonbong General Corp wallet. ALL $2.84M+ in this cluster flows here. 390+ operator accounts routed through. BEP-20 and TRON addresses identified; TRON address blacklisted Dec 2025 (77,340 USDT frozen). | ⚠️ SDN + UN | HIGH |
| 710 COMMAND DEPT (JIHUIBU) | |||||
| 710 Command Dept | Command Bureau | Unknown | JiHuiBu (지휘부) = Command Bureau. Does not match any publicly documented DPRK bureau number. Location of command structure itself is unknown. | - | LOW |
| Unit 1020 | Finance Unit | Unknown (possibly separate from Base 4) | Finance management unit under 710 Command. Absent the '128' prefix seen on sub-cells 128-710 and 128-53, suggesting it may operate from a distinct location. Highest-value operators in the network (rcm, sam) report here. | - | LOW |
| 128-53 | Sub-cell of 710 Cmd | Base 4 (assessed) | Primary evidence node for '128' = Base 4 link. rji0124 verbatim: "financial manager of Base4 128-53." MEDIUM confidence on Base 4 placement specifically for this sub-cell. | - | MEDIUM |
| BASE 3 - 313 MUNITIONS INDUSTRY DEPT, WPK | |||||
| Base 3 / Unit 313 / PN_313 | Military-Industrial Bureau | Pyongyang | 313 General Bureau, Munitions Industry Department (MID), Workers' Party of Korea. Controls DPRK nuclear and missile R&D. Renamed "Machine Building Industry Dept" 2010–2017 to evade sanctions. | ⚠️ SDN + UN | HIGH |
| Korea Sobaeksu Trading Co. | 313 MID Front Company | DPRK / Vietnam operations | OFAC designated July 2025. Dispatched IT workers to Vietnam. Personnel: Kim Se Un, Jo Kyong Hun, Myong Chol Min. "Sobaeksu" (소백수) = a river name in DPRK. Appears 4× in raw chats as a paying unit. | ⚠️ SDN Jul 2025 | HIGH |
| Korea Saenal Trading Corp | 313 MID Front Company | DPRK / Russia operations | OFAC designated. Operated with Russian national Gayk Asatryan to dispatch IT workers. "Saenal" (새날) = New Day. Self-ID: "I am from Saenal. I sent 700 to RB." Appears 2× in raw chats. | ⚠️ SDN | HIGH |
| Korea Songkwang Trading Gen. Corp | 313 MID Front Company / Dispatch Entity | DPRK / Russia operations | OFAC SDN EO 13810. Signed 10-year contract mid-2024 to dispatch 30 IT workers to Russia via Gayk Asatryan. Self-ID: "I am a member of SonKwang Trading company in Coal ministry." Also appears in Ryang Gang branch of this chart (separate node). | ⚠️ SDN EO 13810 | HIGH |
| BASE 4 (KIM CHAEK UNIVERSITY OF TECHNOLOGY) | |||||
| Base 4 | University / Talent Pipeline | Pyongyang | Kim Chaek University of Science and Technology (김책공업종합대학). "MIT of North Korea." Top graduates directly recruited for cyber operations. Confirmed IT worker talent pipeline per US OFAC advisories. | - | HIGH |
| Suk Chon Electronics | Base 4 Affiliate | Suk Chon city, S. Pyongan Province | Operator pkc self-ID: "member of Suk Chon Electronics of base 4." Suk Chon is on the Pyongyang–Nampho rail/road corridor. No sanctions match. Single confirmed payment ($799 ETH, Feb 14 2026). Likely an internal Base 4-affiliated electronics facility. | - | MEDIUM |
| BASE 1 - NAMPHO | |||||
| Base 1 / Nampho Ship | Marine Engineering Institution | Nampho, S. Pyongan Province | Assessed: Nampho College of Marine Engineering or shipyard-affiliated institution. Nampho = DPRK's primary industrial port. Operator self-ID: "UNIVERSITY of Nampho ship in base 1." Not matched to any open-source institution by this exact name. | - | MEDIUM |
| BASE 5 | |||||
| Base 5 | Unknown Bureau | Unknown | 2nd largest unit by total payments. Parent bureau not identified. Contains sub-teams: RedStar 2, UOS, KFM IT, CIC. 'Rigwa' sub-designator used across multiple bases - assessed as shorthand for a boss-level individual named Ri Gwang, not a fixed location. | - | LOW |
| RedStar 2 Team | Internal Team Codename | Base 5 | Internal operational codename - no connection to Red Star OS. 3rd highest-paying unit in network ($271k via operator chorse). True parent organization and real name of team unknown. | - | LOW |
| UOS Team | University | Pyongyang | University of Sciences, Pyongyang. Confirmed IT worker dispatch institution per US OFAC advisories and open-source threat reporting. Operator devsirius-1 base-shifted mid-observation period (rigwa base3 to rigwa base1), demonstrating fluidity of 'rigwa' sub-designator. | - | MEDIUM |
| KFM IT | Unknown Front Company | Unknown (possibly China/SEA) | 'KFM' may be Korean initials of a front company. No OSINT match in public corporate registries. Research gap: search China, Laos, Vietnam, Cambodia for "KFM" tech entities registered by DPRK nationals. | - | LOW |
| CIC Team | Unknown Unit | Base 5 | 'CIC' acronym not matched to any known DPRK entity. Possibly Computer Information Center. Operator ri_cholho holds Payoneer account with Polish male cover identity ([email protected]). | - | LOW |
| RYANG GANG - RYANGGANG PROVINCE | |||||
| Ryang Gang | Regional Unit | Ryanggang Province (량강도), capital Hyesan | Largest observed unit by message volume (410 messages, 40+ aliases) - not necessarily by headcount or revenue. Unit 1020 / 710 Command is the largest by attributed payments. Borders China. AsiaPress (2024, 2026) reported workers dispatched from Hyesan to Shenyang, Changchun, and Russia. Parent controlling bureau unknown. | - | MEDIUM |
| 24 Team | Internal Team Designator | Ryang Gang | Internal operational team designator - likely a rotation number or cohort. No OSINT match. Appears in Ryang Gang branch only. | - | LOW |
| HB-ST / HB Library of Science & Tech | Library (institutional affiliation) | N. Hamgyong Province (assessed) | HB = Hamgyong-bukdo (함경북도) assessed. Operators cite affiliation in payment contexts. Whether this institution functions as a formal employment cover or simply as an organizational label is unconfirmed. Payments appear to flow directly to PC-1234/RB Wallet with no observed direct recipient role for the library, though its full function in the network is not definitively characterized. | - | MEDIUM |
| RS Committee | Special Economic Zone Authority | Rason SEZ (China/Russia border) | Assessed: Rason Special Economic Zone Committee (나선특별시위원회). Rason SEZ = primary DPRK overseas worker staging area. Operator ihor_zhuravskyi uses Ukrainian-sounding cover alias - consistent with confirmed DPRK Eastern European cover pattern. | - | MEDIUM |
| SonKwang Trading Co. | Dispatch Entity (Trading Co.) | DPRK / Russia operations | Korea Songkwang Trading General Corp (OFAC SDN EO 13810). Self-ID: "SonKwang Trading company in Coal ministry." As a dispatch entity, takes a management cut before remittances reach PC-1234 - distinct in structure from the institutional affiliates in this network. | ⚠️ SDN EO 13810 | HIGH |
| JONGBO / PROVINCIAL INFO UNITS - N. HAMGYONG PROVINCE | |||||
| Jongbo / 정보 Unit | Provincial Intelligence Unit | N. Hamgyong Province (assessed) | 정보 (Jongbo) = Intelligence/Information. HMB- prefix assessed = Hamgyong-bukdo (함경북도). Geographic cross-confirmation: operator Super Killer stated in Japanese "watashi no shussin wa chongjin desu" (my hometown is Chongjin, capital of N. Hamgyong Province). | - | LOW |
| HwangBuk Info / HBI | Provincial Info Unit | N. Hwanghae Province (황해북도) | North Hwanghae Province information unit (assessed). HwangBuk (황북) = N. Hwanghae Province abbreviation. No OSINT match beyond provincial naming pattern. | - | MEDIUM |
| HwangNam Info | Provincial Info Unit | S. Hwanghae Province (황해남도) | South Hwanghae Province information unit (assessed). Sub-unit: HwangNam Jin Hung (operator man, $2k). | - | MEDIUM |
| HAM NAM - S. HAMGYONG PROVINCE CLUSTER | |||||
| HamNam JongBo / HNIC | Provincial Intelligence Unit | S. Hamgyong Province (함경남도) | Confirmed name: "This is HamNamJongBo (HNIC) siljok." 'Siljok' (실적) = performance results. HNIC = HamNam Information Center initials. Submits performance reports, not just payment notices. | - | HIGH |
| HamNam ManGyong | Provincial Unit | S. Hamgyong Province (함경남도) | South Hamgyong ManGyong unit. ⚠️ DISTINCT from HamBuk ManGyong (N. Hamgyong) - same naming pattern, different province. Self-ID: "HamNam ManGyong." | - | MEDIUM |
| Ham Nam Dae Un | Provincial Unit | S. Hamgyong Province (함경남도) | Dae Un (대운) = great achievement or great fortune. South Hamgyong Province unit. No further self-identification available beyond geographic prefix. | - | MEDIUM |
| Hamnam Trade | Trade Entity | S. Hamgyong Province (함경남도) | South Hamgyong Province trade entity. No further self-identification beyond geographic prefix. | - | MEDIUM |
| CHONGJIN CLUSTER - N. HAMGYONG PROVINCE CAPITAL | |||||
| ChongJin Special Products (특수품) | Munitions-Adjacent Unit | Chongjin, N. Hamgyong Province | 특수품 = well-documented DPRK euphemism for weapons/munitions. Self-ID: "This is the manager of ChongJin Special Products team." Assessed 313 MID affiliation based on naming pattern - not confirmed. IT workers in munitions-adjacent units is a documented DPRK pattern. | - | MEDIUM |
| ChongJin Medical College | Medical Institution (cited affiliation) | Chongjin, N. Hamgyong Province | Operators cite affiliation in payment contexts. Self-ID: "I am boss of ChongJin Medical College team." Medical college fronts documented in US DOJ IT worker indictments. IT payments flow directly from operators to PC-1234/RB Wallet - college receives nothing. | - | HIGH |
| Chong Jin Railway | Railway Entity | Chongjin, N. Hamgyong Province | ⚠️ SEPARATE from Railway Unjong Sub Company (Pyongyang). Self-ID: "I have sent $4000 from Chong Jin Railway." ($4k + $1,450 + $1,900 in separate transactions). Assessed affiliation: DPRK Ministry of Railways. | - | HIGH |
| ChongJin 21 Company | Unknown Company | Chongjin, N. Hamgyong Province | Self-ID: "Hi, Sir. This is Chongjin 21 company." '21' is likely an internal company or cohort number - a DPRK naming convention seen elsewhere in this network (e.g., '24 Team' under Ryang Gang). | - | HIGH |
| OTHER UNITS - GEOGRAPHIC AND SPECIALTY | |||||
| Rajin Marine Transport Univ. | University | Rason SEZ (founded 1968) | Rajin University of Marine Transport. Established July 1968 in Rason SEZ. Trains navigators, shipping specialists, and port managers. Operator hsc1114 (Han Song Chol) holds US bank account also linked to PC-1234 infrastructure. | - | HIGH |
| HaeJu Jaegyong Trade Co. | Trade Company | Haeju, S. Hwanghae Province | Full name confirmed verbatim. Haeju (해주) = capital of South Hwanghae Province. Jaegyong (계경) = patriotic or directional name. No sanctions match. Research gap: Korean-language query 해주계경무역회사. | - | MEDIUM |
| Pyongyang Computer Technology Univ. | University | Pyongyang | Assessed: Pyongyang Computer Technology University - primary DPRK IT academic institution alongside Kim Chaek University (Base 4). One operator identified (esp32, $4k). | - | MEDIUM |
| WonSan Rakwon Export Product Production Co. | Export Production Co. (Employment Cover) | Wonsan, Kangwon Province | Full name confirmed: "I am a member of WonSan Rakwon Export Product Production Company Team." Wonsan = major DPRK port city. 락원 (Rakwon) = Paradise. Employment cover - money flows directly to PC-1234, not to this entity. Wonsan hosts major naval base, shipyards, and Kim Jong Un's resort zone. | - | HIGH |
| Kumsan Rakwon (락원) | Unknown Unit | Unknown | Kumsan (금산) = Gold Mountain. 락원 = Paradise. Patriotic stylized name - no geographic anchor or bureau match identified. No OSINT match. | - | LOW |
| Jonsong-Moran | Named Entity | Unknown (possibly Pyongyang-adjacent) | Full compound name confirmed: "Hi, This is Jonsong-Moran." and "This payment is from Jonsong Moran." Jonsong (전성) = dedication/sincerity. Moran (모란) = Peony. Not the Moranbong area or Korea Rakwon Trading Corp. No sanctions match. | - | MEDIUM |
| HamBuk ManGyong | Provincial Unit | N. Hamgyong Province (함경북도) | Self-ID: "Organization is: HamBuk ManGyong." ⚠️ DISTINCT from HamNam ManGyong (S. Hamgyong) - same naming pattern, different province. Two separate entities in this network. | - | HIGH |
| HamBuk Economy Info / People's Committee | Provincial Government Unit | N. Hamgyong Province (함경북도) | Full confirmed name: "Ham Buk Economy Information Technology Exchanging Company." Operator sjg1019 also self-IDs as "Song JinGuk of HamBuk People Committee" - same individual may represent both the economic info unit and the provincial people's committee. | - | HIGH |
| Rason Zonja (전자) | Electronics Unit | Rason SEZ | 전자 (Zonja) = Electronics. Assessed: Rason electronics unit consistent with Rason SEZ tech sector. No OSINT match beyond naming inference. | - | MEDIUM |
| RasonSyolGye (설계) | Design/Engineering Unit | Rason SEZ | 설계 (SyolGye) = Design or Engineering. Assessed: Rason design or engineering unit consistent with SEZ tech sector. No OSINT match. | - | MEDIUM |
| Railway Unjong Sub Company | Railway Entity | Unjong district, Pyongyang | ⚠️ SEPARATE from Chong Jin Railway (Chongjin city). Self-ID: "This is transaction of Railway Unjong Sub Company." Unjong (운정구역) = Pyongyang administrative district created in 1995. DPRK Ministry of Railways affiliation assessed. | - | HIGH |
| SinDong | Unknown Unit | Unknown (possibly Pyongyang-adjacent) | SinDong (신동) = "new village/east." Listed alongside Unjong in payment source data. Self-ID: "This is a payment from SinDong." May be a sub-unit of Unjong or an adjacent entity. No OSINT match. | - | LOW |
| Metal 2 | Industrial Sector Unit | Unknown | Metals/industrial sector. '2' suggests a numbered series - Metal 1 likely exists but not in this dataset. No OSINT match. One operator (c2m-rjg) identified. | - | LOW |
| Industry 2 | Industrial Sector Unit | Unknown | Industrial sector. Cover email confirmed: [email protected] (Western female name cover) linked to operator kh430. '2' suggests numbered series. | - | LOW |
| Tech College | Technical College | Unknown | Operator prefix 'hctc-ksi0905' may contain college initials. Possible candidates: Hamhung Chemical Technology College (함흥화학공업대학) or similar. Research gap: search 'hctc' as a DPRK institution abbreviation. | - | LOW |
| Tourism | Tourism Sector (Employment Cover) | Unknown | DPRK state controls all tourism (Korea International Travel Company / KITC). Tourism fronts are a documented low-scrutiny IT worker cover - payment receipts can be attributed to tourist service fees. Two operators identified (hunter $1k, shp $2k). | - | LOW |
| Bakdu | Patriotic-Named Unit | Unknown (Ryanggang Province connection possible) | Bakdu (백두) = Paektu Mountain (백두산) - most politically sacred location in DPRK, birthplace of Kim Jong Il per official narrative, associated with the Kim family "Paektu bloodline." Organizations using this name often have direct party or military affiliations. Self-ID: "This is for Bakdu." ⚠️ Separate from EastSea. | - | LOW |
| EastSea | Named Unit | Unknown | 동해 = East Sea (Sea of Japan, DPRK designation). ⚠️ Separate entity from Bakdu - confirmed from independent payment entries. Self-ID: "Please check this payment (EastSea)." Operator vanguard ($3k) attributed here. | - | LOW |
| Jongju | City-Named Unit | Jongju city, N. Pyongan Province | Jongju (정주) = city in southern N. Pyongan Province. Major rail junction. Real name of one operator confirmed: KangGon ("I am KangGon from Jongju team"). Jongju hosts the world's largest known rare earth element (REE) deposit - contextually significant. ⚠️ Separate from JonDang. | - | HIGH |
| JonDang | Unknown Unit | Unknown | Separate entity from Jongju - confirmed from source data. Payment label in raw chats: "JonDang $2800," "Jondang $3050." Total ~$12,800. No self-introduction message found. Korean reading ambiguous (전당 = political hall, or other). Research gap: look for JonDang self-ID. | - | LOW |
| Kwang Dae / SUCCESS | Unknown Unit | Unknown | No verbatim self-identification in raw chats. Operator midas-1 ($21k, 30 messages) is the only identified member - high activity suggests an active unit despite no name confirmation. | - | LOW |
| Branch | Sub-Office | Unknown | Sub-office designation - parent unit not identified. 'Branch' likely translates bun-so (분소) or ji-sa (지사) - standard DPRK terms for a sub-office. Two operators (pjc0115, crystal) with no message activity in dataset. | - | LOW |