Reframing Insights
2025-11-18 • Chollima Group •
https://chollima-group.io/posts/reframing-insights-our-research-msmt
Chollima Group uses the MSMT sanctions report to reframe its prior research on DPRK IT worker networks, especially activity tied to Tanzania, Guinea, Nigeria, and other African locations. The article links the Tanzania-based Bells Inter Trading cluster and IT worker Lian Hung to Bureau 53 and Junggongchon Trading Corporation, while noting possible but revised assessments about other front companies such as Haegumgang Trading Corporation. It also describes a Guinea-based IT worker using personas including David Orion, Bill Oneil, and GenZhe Wu to seek freelance development work, including with Guinean companies and at least one U.S. SaaS company, with telemetry suggesting travel or connectivity back to DPRK-linked infrastructure. The Nigeria section shifts from IT work to Korea National Insurance Company activity, describing Kim Yong Jin’s apparent access to Universal Insurance PLC communications and KNIC-linked insurance dealings. The piece matters because it connects strategic sanctions reporting with granular persona, front-company, geography, and facilitation evidence for DPRK revenue-generation operations.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| URL | https://wasaya-business-gn.com/… | 2025-11-18 | 2025-11-18 |
| URL | https://www.upwork.com/freelanc… | 2025-11-18 | 2025-11-18 |
| URL | https://www.facebook.com/people… | 2025-11-18 | 2025-11-18 |
| URL | https://hubstafftalent.net/prof… | 2025-11-18 | 2025-11-18 |
| URL | https://www.upwork.com/freelanc… | 2025-11-18 | 2025-11-18 |
| URL | https://hubstafftalent.net/prof… | 2025-11-18 | 2025-11-18 |
| URL | https://hubstafftalent.net/prof… | 2025-11-18 | 2025-11-18 |
| URL | https://ndeyetoudista.com/#about | 2025-11-18 | 2025-11-18 |
| URL | https://qihangsoftware.com/#team | 2025-11-18 | 2025-11-18 |
| URL | https://clay.earth/profile/yinx… | 2025-11-18 | 2025-11-18 |
| URL | https://hk.linkedin.com/in/yinx… | 2025-11-18 | 2025-11-18 |
| URL | https://www.fiverr.com/greatemp… | 2025-11-18 | 2025-11-18 |
| URL | https://hubstafftalent.net/prof… | 2025-11-18 | 2025-11-18 |
| DOMAIN | lpdevteam.com | 2025-11-18 | 2025-11-18 |
| DOMAIN | clay.earth | 2025-11-18 | 2025-11-18 |
| DOMAIN | acti-forage-gn.com | 2025-11-18 | 2025-11-18 |
| DOMAIN | ndeyetoudista.com | 2025-11-18 | 2025-11-18 |
| DOMAIN | wasaya-business-gn.com | 2025-11-18 | 2025-11-18 |
| DOMAIN | qihangsoftware.com | 2025-11-18 | 2025-11-18 |
| DOMAIN | hubstafftalent.net | 2025-11-18 | 2025-11-18 |
| IPv4 | 183.182.105.91 | 2025-11-18 | 2025-11-18 |