BABYLONGROUP
2025-08-25 • Chollima Group • Dubai, Crypto, Moonstone Sleet, and the Pivot Ody…
BABYLONGROUP is a cluster name introduced by the research group Chollima Group in an August 2025 post that began by pivoting off Kaspersky and Microsoft reporting on Moonstone Sleet's DeTankZone fake cryptocurrency-game campaign into its "legitimate" predecessor project, DefiTankLand. Investigating DefiTankLand's development team and related GitHub accounts, including ones tied to a "Galaxy Foundation"/BabylonSwap organization, the researchers clustered DPRK IT workers who focus on self-created web3/blockchain freelance projects, at times acting as CTOs while installing fabricated or recruited front-persons as CEOs; one non-DPRK Chinese national in the cluster also administers a Chinese cybercrime marketplace. A September 2025 follow-up traced a related persona to Bells Inter Trading Ltd, a suspected North Korean front company operating under Tanzanian work permits in Dar es Salaam that published a portfolio of mobile VPN and game apps totalling roughly 12 million installs, generating revenue while overlapping with the same DeTankZone investigation.
-
60
Related Actors
-
690
Related Reports
Related Actors
Related Reports in This Cluster
Top Authors
View BABYLONGROUP reports only