lazarusholic

Everyday is lazarus.dayβ

From Vientiane to Vladivostok

2025-02-18, ChollimaGroup
https://chollima-group.io/posts/tracking-a-north-korean-it-worker-cell/
#ITWorker

Contents

From Vientiane to Vladivostok
Tracking a North Korean IT Worker Cell from Laos utilizing open-source data.
/ 9 min read
Background:
Late last year, we stumbled upon a trove of pictures and logs belonging to an IT worker stationed in Laos. The pictures, discovered in an open Dropbox folder, are shot in a “home movie” style and follow a group of North Korean IT workers who resided in Laos between 2021 and 2023.
In the past year, Laos has gained more public attention as an IT worker hotspot due to Palo Alto’s reporting on Niko Sonexarth
, an IT Worker involved with Contagious Interview, and sanctions being placed on three North Korean front companies run by Department 53, who directed groups of IT Workers in Laos:
| Sanctioned Company | Sanctioned Representative | Active in Laos Since |
|---|---|---|
| Korea Osong Shipping Co | Son Kyong Sik | 2022 |
| Chonsurim Trading Corporation | Jong In Chol | …