Category: investigations

Moonstone Sleet & Sin Chong Min

The modern world is built on information technology and the reliance on IT is ever growing. Unfortunately, this reliance also provides opportunity for individuals to take advantage and look for ways to exploit systems and people for their own advantage. The North Korean regime is extremely good at being able to spot exploitation opportunities. Especially when it means providing funds for Kim Jong Un’s nuclear and ballistic weapons program.

North Korean IT workers

North Korea send thousands of IT workers overseas to countries including China & Russia. These IT workers then gain employment remotely with companies around the world, either directly or through contract IT companies. Not only is employing North Korean IT workers a breach of international sanctions, it is also extremely dangerous to the employing organization. Any degree of access given to the North Korean workers opens the potential for malicious intent and cyber activity. A recent example of this involves US security company named KnowBe4. The company was looking to hire a software engineer and hired an individual who turned out to be North Korean and was using a stolen US identity and immediately began loading malware onto a corporate device.

How do North Korean IT workers gain employment?

Back in 2022, the FBI, US Department of State & US Department of the Treasury released an advisory on North Korean IT workers that detailed some of the tactics used to trick companies and gain employment. These tactics include operating under fake or stolen identities and conspiring with US nationals to pose as US citizen. Recently, a man from Tennessee was arrested for allegedly running a laptop farm and providing North Koreans with US internet connections to enable their activity.

Moonstone Sleet

The lines between IT work and malicious cyber activity become very blurred when North Korea are involved. In May of this year, Microsoft released a detailed investigation into a new threat actor labelled Moonstone Sleet. Microsoft’s investigation noted that Moonstone Sleet actors were actively trying to gain employment in software development positions at legitimate companies but were also carrying out cyber attacks at the same time.

Pyongyang Papers can reveal that we believe a DPRK IT worker named Sin Chong Min manages a number of IT workers that have been conducting activity associated to Moonstone Sleet. Microsoft’s investigation also detailed the use of an online game called DeTankWar (AKA DeFiTankWar, DeTankZone TankWarsZone). The game looked legitimate and had a substantial social media presence but appears to be a fraudulent copy of the online game DeFiTankLand. The fraudulent website appeared to use a logo in the style of the legitimate website as well as some of the screenshots of the game play.

The website logos from the fraudulent DeTankZone & legitimate DefiTankLand websites

Large revenues

Our sources have informed us that Sin Chong Min is believed to be located on the North Korean/China border. Reports suggest that activity by the group is ongoing as recently investigated malicious packages displayed tactics, techniques & procedures (TTPs) aligned with Moonstone Sleets known activity. The latest report by the former UN DPRK Panel of Experts states that DPRK IT workers can earn the regime between $250 million & $600 million annually. This is a huge amount of revenue heading back to the regime when you consider this figure does not include other cyber activities such as cryptocurrency thefts.

The North Korean regime will always find ways to evade sanctions is pursuit of more advanced and lethal weapons. IT workers abroad will continue to play a pivotal role in this. Detection of North Korean IT workers such as Sin Chong Min maybe extremely difficult. Pyongyang Papers would urge any business looking to hire IT workers, to follow the May 2022 advisory and the updated guidance issued in October 2023 by the US and South Korea authorities.

If you have any additional information regarding Sin Chong Min or any other North Korean sanctioned activity, please get in touch through the ‘Contact Us’ page.

DPRK companies continue tobacco trade

Over the last few months, many news outlets have reported on the strange sight of hundreds of rubbish-filled balloons falling over South Korea. This petty act was not the work of a school child, but the activity of a nation’s government – North Korea. These balloons were filled with rubbish including household waste, manure and cigarette butts. It’s these cigarette butts that are often gathered by North Koreans after large public events to sell to garment-makers, according to Radio Free Asia. Ironically, before they end up in balloons or being foraged by desperate North Koreans, cigarette butts are integral to one of North Korea’s most valuable industries – tobacco.

The importance of tobacco

The DPRK’s tobacco industry is hugely important to the regime, with companies such as the North Korean General Tobacco Corporation (NKGTC) owned by the state. It is believed that 2.3% of North Korea’s arable land is devoted to growth of tobacco – the 4th highest percentage of arable land dedicated to tobacco in the world! This clearly undermines the regime’s attempts to appear responsible by introducing tougher legislation on smoking in public spaces and persuading citizens to quit their habits. Despite this, tobacco products are still viewed as a status product in North Korea and is valued as a luxury product.

Here at Pyongyang Papers we have investigated and written a number of articles highlighting sanctioned luxury goods dealings between DPRK and other nations supplying such goods. One such luxury item that we have reported on previously is tobacco. Just last year, British American Tobacco was fined $635m after a subsidiary admitted selling cigarettes to North Korea in violation of US sanctions. According to the United Nations Security Council, tobacco is the fourth largest import into the country, so losing a supply of tobacco on this scale is sure to lead to Kim Jong Un, a lifelong smoker, and the regime looking for other suppliers of this valuable commodity.

Ponyong Tobacco trading Corporation & G-EM Aromatics Ltd

Pyongyang Papers understand that North Korean Ponyong Tobacco Trading Corporation is working on a deal to purchase tobacco and additives from a Bulgarian tobacco flavoring company “G-EM Aromatics”, a company based in Sofia, Bulgaria with Manolis Gkoulgkountinas listed as the Director according to his LinkedIn profile. Surely this activity is in direct violation of UN and US sanctions? Yes. In typical fashion, to evade sanctions and hide dealings of North Korea, any deal will be facilitated by a Russian company as the buyer. The Russians are fully aware of their involvement, and we believe that it is highly likely that Ponyong branded cigarettes will find their way into the Russian market.

A selection of tobacco flavors on the G-EM website

Song In Su

It seems that Russian linked entities are playing an increasingly central role in North Korea’s tobacco related sanctions evasion. We have information that a DPRK official, based in Russia, Song In Su has aided a shipment of Brazilian cut tobacco to the DPRK entity Korea Ryugyong Corporation worth hundreds of thousands of dollars. Pyongyang Papers has written extensively about Ryugyong Corporation previously, highlighting how this state owned entity is pumping funds into the DPRK’s nuclear weapons program. As a result, this new business deal is particularly concerning. Further investigation has revealed that, in 2023, Song In Su aided shipments of tobacco to the previously mentioned DPRK entity – Ponyong Tobacco Company, again worth hundreds of thousands of dollars.

As for the seller of this Brazilian-cut tobacco, we have been made aware that a Hong Kong-based trading company named “The Honor Trading International Ltd” are acting as facilitators in this deal. We understand that this company is not new to enabling prohibited shipments to DPRK and may be a frequent supplier to the country. Their actions mean that they are essentially a regular investor into the nuclear weapons program of a dangerous regime. From what we have uncovered so far It is clear that sanctions alone are not stopping businesses from getting involved with North Korean activity, and more must be done to actively stop them.

If you have any information regarding the North Korea tobacco trade or any of our investigations please get in touch using the ‘contact us’ page.

From Russia to North Korea – Ardis

The North Korean weapons program continues to be Kim Jong Un’s main priority. The ordinary citizens of North Korea are the ones who ultimately suffer in Kim’s desire to develop a deadly arsenal. In February this year Kim stated that South Korea was the “primary enemy … and can be attacked and destroyed at any time.” The regime has spent the last decade ensuring that the weapons at their disposal have been modernized and enhanced, ensuring that prolonged peace on the Korean peninsula seems increasingly unlikely. Sophisticated weapons require thousands of components and with current sanctions are aimed at ensuring North Korea is unable to develop these weapons. Unfortunately, this is where companies such as Ardis Group of Companies can profit, providing they are willing to break those sanctions!

Ardis – A history of breaking sanctions

One company that is no stranger to working with, and is a key supplier of bearings and other items to North Korea is Ardis Bearings. One of the companies that sits within the Ardis Group of Companies LLC. Ardis Bearings were originally sanctioned by the United States Treasury in 2017 for supplying dual-use components to the Tangun Trading Company, also known as Korea Kuryonggang Trading Corporation, A North Korean company designated by the UN & US for its involvement in the DPRK nuclear and ballistic weapons program.

Igor Aleksandrovich Michurin (Мичурин Игорь Александрович), the General Director of Ardis Bearings, was also sanctioned at the time. This was followed up by an additional sanction in March 2022 against the Ardis Group of Companies LLC for transferring sensitive items to North Korea’s missile program. Igor and his companies are a key supplier of bearings plus other items to DPRK. Although not listed as the CEO, Igor has several companies at his disposal in his attempts the hide his illicit activities. Some of the companies include:

• Gatchinskiy Bearing LLC
• LLC PKF “Profpodshipnik”
• Belagromekhanizm LLC
• Trading House Ardis LLC
• Bearings on Lipetsk Street, Moscow

From our current investigations we believe that Igor uses his contacts and his various companies to act as the middleman in procuring goods and services for the DPRK. These goods will then be transported to North Korea using unofficial channels and well used smuggling routes. Igor earns a percentage in commission as part of the deal but the DPRK are desperate for the items he can source and supply, to progress their weapons programs, so are willing to pay inflated prices. Unfortunately, Pyongyang Papers does not have all the information surrounding Igor and the networks used to smuggle goods to North Korea. We welcome any additional information or details we can investigate through our ‘Contact Us’ page.

Bearings on Lipetsk Street, Moscow. November 2023

Additional activities

Igor and his group of companies have years of experience when dealing with North Korea. That experience has obviously led to other opportunities. A 2018 article from Reuters details how Igor created a construction company – Mistroy LLC to employ North Korean laborers. Pyongyang Papers can also reveal that in the past Igor also hosted a number of DPRK IT workers at what is now an obsolete company, Ardis Financial Construction Company.

Its clear that Igor and his group of companies are proficient at avoiding sanctions. And after Vladimir Putin’s recent trip to North Korea, the new defense pact may signal an era of Russia & its companies being even more willing to help the DPRK advance its nuclear and ballistic weapons. How China will react to a strengthened relationship between North Korea & Russia remains to be seen but as long as there is money to be made or mutual benefits gained without proper consequences, entities such as Ardis and countries such as Russia will continue to break international sanctions. We are still investigating Igor and his group of companies and welcome any additional information regarding his company’s activities with North Korea. If you have any additional information please get in touch via the ‘Contact Us’ page

DPRK sanctions evasion brewing in Mongolia

Imagine warming up on a cold evening in Ulaanbaatar with some nutritious food on the 15th floor of the Daco Building, overlooking the skyline of Mongolia’s capital city. Sounds idyllic but there is an issue…. The restaurant is operated by the North Korean regime and is breaking sanctions by employing North Korean workers and directly funding Kim Jong Un’s nuclear and ballistic weapons program.

North Korea and the restaurant business

Pyongyang Papers has reported on DPRK activity in Mongolia & North Korean restaurants previously. North Korean restaurants around the world are believed to earn the regime about $700 million annually and are also used to launder money for the country, with many restaurants allegedly run by Reconnaissance General Bureau (RGB) agents. The RGB is the DPRKs primary intelligence agency and is responsible for a huge range of activity from obtaining foreign currency to running much of the country’s cyber capabilities.

UN resolutions forbid the employment of North Korean workers abroad and all North Korean workers were supposed to be repatriated back to DPRK by the end of December 2019. This deadline passed but North Korea has continued to send its citizens abroad, with greater numbers, in fresh batches as the country has relaxed its Covid-19 pandemic controls. Estimates suggest that up to 100,000 North Koreans worked overseas in 2023.

During the pandemic years, there were several reports of restaurants struggling and closing with limited custom due to pandemic restrictions and enforced sanctions. It appears that these issues may now have disappeared as the latest report, from the currently disbanded Panel of Experts, details dozens of restaurants operating across Asia in countries such as China, Russia & Laos. The report includes imagery taken from social media confirming the presence of North Korean nationals working at the restaurants.

The Pyongyang Baek Hwa Restaurant

One restaurant that isn’t covered in the Panel of Experts report is the Pyongyang Baek Hwa Restaurant in Ulaanbaatar, Mongolia. We have been informed that a delegation of DPRK restaurant workers are set to travel to Mongolia to work in the re-opened restaurant. The restaurant was confirmed closed during a visit in 2022 by DailyNK but is now back open. The restaurants Facebook page became active again during December 2023 and has been offering sim cards for use in South Korea! The phone number listed against these posts has also recently advertised for a chef and a dishwasher to be trained at a Korean restaurant.

The restaurant signage is still displayed on the Daco Building – Street view from 2023

As part of our investigations, we can confirm that the restaurant is still located at the same address as it previously was and we received no response to our offer of comment by the restaurant itself. Pyongyang Papers has not been able to confirm if the advertisements for staff at a Korean restaurant are directly related to the Pyongyang Baek Hwa restaurant but we continue to investigate North Korean activity in Mongolia and will publish any findings at a later date.

The Pyongyang Baek Hwa restaurant is not the only restaurant to re-open as North Korea continues to find ways to circumvent sanctions and earn much needed currency for the regime. In fact, some of the restaurants appear to be very busy and are clearly serving the regime well. If countries including China, Russia, Laos & Mongolia continue to facilitate the regimes actions so easily then the unfortunate North Korean citizens who are forced to work abroad will continue to be exploited treated like slaves.

If you have any information regarding the Pyongyang Baek Hwa Restaurant or any other sanctioned North Korean activity, please get in touch through the ‘Contact Us’ page.

Moonstone Sleet & Sin Chong Min

By pp_admin / September 16, 2024

The modern world is built on information technology and the reliance on IT is ever growing. Unfortunately, this reliance also…

DPRK companies continue tobacco trade

By / August 12, 2024

Over the last few months, many news outlets have reported on the strange sight of hundreds of rubbish-filled balloons falling…

NATIONAL AEROSPACE TECHNOLOGY ADMINISTRATION (NATA)

By pp_admin / July 29, 2024

Sanctioned Entity – DPRK EU Sanctions ListSource: https://webgate.ec.europa.eu/europeaid/fsd/fsfNATA is involved in the DPRK’s development of space science and technology, including…

From Russia to North Korea – Ardis

By / July 16, 2024

The North Korean weapons program continues to be Kim Jong Un’s main priority. The ordinary citizens of North Korea are…

DPRK sanctions evasion brewing in Mongolia

By / June 6, 2024

Imagine warming up on a cold evening in Ulaanbaatar with some nutritious food on the 15th floor of the Daco…

OLEG NIKOLAEVICH KOZHEMYAKO

By pp_admin / May 31, 2024

Sanctioned Individual – DPRK EU Sanctions ListSource: https://webgate.ec.europa.eu/europeaid/fsd/fsfGovernor, Primorsky Krai, Russian Federation.Data:Name: Oleg Nikolaevich KOZHEMYAKOBirthdate: 1972-03-17Aliases:Олег Николаевич КОЖЕМЯКОOleg Nikolaevitch KOZHEMYAKO

KIM CHOL SOK

By pp_admin / May 31, 2024

Sanctioned Individual – DPRK EU Sanctions ListSource: https://webgate.ec.europa.eu/europeaid/fsd/fsfan intelligence officer of the Reconnaissance General Bureau of the DPRK.Data:Name: KIM Chol…

EASTERN STEVEDORING COMPANY

By pp_admin / May 31, 2024

Sanctioned Entity – DPRK EU Sanctions ListSource: https://webgate.ec.europa.eu/europeaid/fsd/fsfOperates the terminals at the main container port of the Russian Far-East in…

AN SE-HO

By pp_admin / May 31, 2024

Sanctioned Individual – DPRK EU Sanctions ListSource: https://webgate.ec.europa.eu/europeaid/fsd/fsfDiplomat. a DPRK diplomat who was formerly the First Secretary at the Embassy…

KOREA NAMGANG TRADING COMPANY

By pp_admin / May 31, 2024

Sanctioned Entity – DPRK EU Sanctions ListSource: https://webgate.ec.europa.eu/europeaid/fsd/fsfKorea Namgang Trading Company.Data:Name: Korea Namgang Trading CompanyAddresses:Pyongyang, KOREA, DEMOCRATIC PEOPLE’S REPUBLIC OFAliases:Koreai…

Here at Pyongyang Papers, we have investigated multiple illicit oil trade deals so the following investigation will be no surprise to regular readers. The more strategic relationship between Moscow and Pyongyang has been powered by DPRK weapons sales to Russia, for use against Ukraine. South Korea estimate that North Korea has shipped 6700 containers of ammunition since September 2023. We do not believe the North Korean regime would do this without some form of payment and it appears that fuel and oil is likely part of Russia’s offer.

From previous deals of this nature, we know that the DPRK are proficient at using “middle men” to hide their trade deals but recent activity by Russia and North Korea appears to be more bold. After the recent Russian veto, the UN Panel of Experts is currently disbanded and the US have been quick to announce new sanctions will be imposed on Russia for transporting more than 165,000 barrels of refined petroleum to North Korea in March alone!

Reports of Russian oil heading to North Korea

The Russian supplies of oil to North Korea were first reported by the Financial Times and the Royal United Services Institute (RUSI) in March and included satellite imagery of North Korean tankers docked in Russian ports. However, this is not the only oil deal between Russia and DPRK. Pyongyang Papers have been informed that a North Korean entity named Sinyang Corporation are working with a Russian representative on a deal to supply hundreds of thousands of tonnes of Russian diesel oil to North Korea. We believe that the first shipment was delivered in March.

Images of the North Korean tankers in Russian port, taken from Financial Times and RUSI investigation

Under UN sanctions imposed by the 1718 committee, countries are legally required to report sales of refined petroleum to the Security Council. However, with the committees Panel of Expert mandate now expired Russia and North Korea obviously believe trades of sanctioned cargo can be conducted directly with ease. We would be extremely surprised if Russia provides any honest reports of sales to the UN, even with the imagery above confirming North Korean activity at Russian ports!

Additional deals between the two countries

During our investigations, Pyongyang Papers also discovered another North Korean company looking to purchase diesel fuel from Russia. The Korea Sungnisan Trading Corporation was sanctioned back in 2022 for acting as a front company associated with the Ministry of Rocket Industry and continue to ignore sanctions imposed against them. The proposed deal involves using the already sanctioned Russian state transportation company, Sovcomflot, to deliver the diesel fuel into the North Korean port of Nampo. Sovcomflot were originally sanctioned in early 2022 due to the Russian invasion of Ukraine and were sanctioned again in February of this year. Recent reports from the CEO, Igor Tonkovidov suggest that sanctions are impacting the companies ability to trade. This may go some way to explaining why they are so keen to help facilitate trade with North Korea, especially if they think the shipments can go unpunished!

Sanctions may be impacting Russian companies but with North Korea’s desire for oil and help, they are able to find it all to easy to continue conducting sanctioned and often dangerous activity. The recent Panel of Experts Report contains a letter from 55 member states detailing a breach in the yearly 500,000 barrel cap of oil exports to North Korea before the middle of 2023 including imagery. The letter recommended that the committee should inform all member states to immediately cease any supply of petroleum products to the DPRK for the remainder of 2023. Of course, the evidence was disputed by Russia and China who both failed to endorse the proposal and continue to hamper efforts to limit North Korea’s nuclear and ballistic missile program.

Please get in touch with us if you have any information on the companies or trades mentioned in this article. Pyongyang Papers appreciates any information that could help with future investigations and articles.

Korea Chinson General Corporation continue in Africa

Pyongyang Papers has continued to investigate Korea Chinson General Corporation and their activities in Africa. Our previous article investigated a contract between the Nigeria company Skynext Services Ltd and Chinson in an obvious violation of UN Security Council resolutions which ban all member states from employing DPRK workers. The aim of this ban is to try and limit the funds heading back to the regime, where it is used to advance the North Korea nuclear & ballistic weapons program.

More Chinson activity in Nigeria

Korea Chinson General Corporation continue to provide North Korean workers to companies in Nigeria. Pyongyang Papers have been informed that Chinson have been supplying workers to the Soroade Bakery & Confectionery Company. Soroade are based at New Auditorium Road, Boun Village, Mowe, Ogun State and lists Husaini G Dumbarambe as its Director. Social media posting from late 2022 appear to verify our claim and shows North Koreans associated with the bakery enjoying some free time.

Social media posting showing North Korean workers in Nigeria

Chinson active in other African countries

Nigeria is not the only country that the Korea Chinson General Corporation actively look to send North Korean workers to. Ethiopia also appears to be lucrative for the company as they continue to exploit DPRK citizens in order to maker money for the regime. Our sources have also informed us of a contract between the Chinson office in Ethiopia & the Ethiopian Construction Design and Supervision Works Corporation (ECDSWC). The contract was signed on 1 November 2022 and covers a two-year period for DPRK geophysicists, a Hydro-Mechanical engineer and a team leader/civil engineer. ECDSWC are an engineering company that was created by merging three companies together with the “commitment to the creation of knowledge base and provision of excelling & sustainable engineering solutions to the challenges of our people throughout Africa.”

In October 2016 the Ministry of Foreign Affairs of Ethiopia announced that ECDSWC and the Korea Rural Corporation (KRC) from South Korea had signed a memorandum of understanding encouraging both sides to secure projects in which both are mutually interested. Pyongyang Papers is certain that the memorandum does not include hiring North Korean workers! Pyongyang Papers contacted the Ethiopian Construction Design and Supervision Works Corporation about the contract but they did not reply.

Add the contract to the claims in the latest UN Panel of Experts report that an official from Chinson and an official from the DPRK embassy in Nigeria traveled to the Niger to collect hundreds of thousands of US dollars in cash, and bought the funds back to Nigeria. It becomes very clear that North Korea continues to find ways to circumvent sanctions and fund its nuclear & ballistic weapons program as ordinary citizens continue to suffer. Nigeria and Ethiopia are both UN member states and need to prove that they enforce the sanctions they are committed to.

As always, if you have any information North Korean sanctions evasion or Chinson, please get in touch through the ‘Contact Us’ page.

North Korea secure labor deal in Nigeria

North Korean business deals with countries on the African continent is well documented and extensive. Pyongyang Papers has conducted several investigations looking at sanctions breaking in the region and this time we aim to shine a light on one country in particular – Nigeria

Nigeria relations

“Unity and Faith, Peace and Progress” – Nigeria’s national motto. Unfortunately, North Korea does not share any aspects of this motto and would rather disorder, betrayal, conflict and decline. Nigeria has the largest economy in Africa and formally established diplomatic relations with North Korea in 1976. In 2014, the two countries signed an economic cooperation agreement in the areas of knowledge exchange, information technology and public sector exchanges of modern technology. Both Nigeria and the DPRK maintain embassies in each other’s countries and as recently as 2022, the UN panel of experts were investigating information that suggested Nigeria were planning on purchasing $3.5 million worth of military equipment with the deal being brokered by the Haegumgang Trading Corporation. A weapons-trading entity belonging to the DPRK Ministry of People’s Armed Forces.

Current activity

Given Nigeria’s warm relationship with North Korea, it should come as no surprise that the DPRK regime continue to use the country as a means to generate revenue for their nuclear and ballistic weapons program.

One company that seems to feature quite heavily in Nigeria is Korea Chinson General Cooperation, who have been investigated in Nigeria previously. Pyongyang Papers have been made aware that UN sanctioned DPRK workers are working within blanket factories, tire factories, plastic bag factories and also a security company.

To add to this, our sources have also passed us a copy of a contract regarding a three year deal with a Lagos based company called Skynext Service Ltd to aid the construction and running of the Lagos rubber factory. The deal involves Chinson providing Skynext with a range of North Korean laborers including:

• Two structural design engineers
• Two interpreters
• Thirteen skills constructors
• Two heavy vehicle mechanics
• Twenty one rubber factory machinists

Extracts taken from the Agreement between Skynext Service Ltd and Korea Chinson General Corporation

The contract is valid for three years and states it will be automatically renewed at the end of each three year period. We are still working to confirm the presence of the DPRK workers for Skynext as the contract also states “The parties further agreed to implement the contract … at a time when the global pandemic of COVID-19 has been resolved and the dispatch of experts from Chinson is possible. But will be valid until July 2023 at latest.” The contract was signed and dated by Mr Ibrahim Mohammed Musaddiq (representing Skynext) and Mr KO Yong Myong (representing Chinson) on 18th August 2022.

The contract lists the address for Skynext as 3 Avenue, Festac but our investigation suggests they may now be located at Commercial Road, Apapa in Lagos. Information regarding the company’s type of activity is limited but the contract and import information available online suggest they are in the manufacturing business. Pyongyang Papers reached out to Skynext directly for comment about their sanctioned activity but received no reply.

The future

With the North Korean borders beginning to open up it is highly likely that North Korean workers will begin moving around the globe again as DPRK companies look to fulfill contracts drafted during the pandemic, evade sanctions and raise funds to enable the regime to continue developing nuclear weapons. The contract between Skynext and Chinson proves that even when the North Korean border is sealed shut and ordinary citizens are believed to be starving, Kim Jong Un and the regime are still content to exploit ordinary DPRK citizens for their own despicable gains.

Pyongyang Papers aims to expose any sanctioned North Korean activity and relies on its sources. If you have any information in relation to this article or any other DPRK activity please get in touch through the ‘Contact Us’ page.

Nam Un Gyong heading back to the DPRK

Pyongyang Papers has continued its recent investigations into the illicit money-making schemes of North Korean individual Nam Un Gyong and her daughter, Ri Son Chong. As previously reported, Nam owned and ran a restaurant called the Blue Flower in Cambodia, this is a blatant violation of UN sanctions which prohibits DPRK individuals working abroad. The money earned from DPRK nationals abroad such as Nam and her daughter, is sent back to the DPRK regime and continues to fund its nuclear weapons program.

The Cambodian government ordered the Blue Flower to close and so we have been keen to see what Nam and Ri have been doing since the closure of the restaurant.

Ri Son Chong was studied business administration at a University in Cambodia, but we know she is also involved in the illicit endeavors of her mother and some of her own. Ri Son Chong helped both in the kitchen and on the cashier desk at the Blue Flower until its closure, whilst also facilitating the production and sale of kimchi to restaurants in the local area of Phnom Penh. We contacted the Blue Flower Facebook page after releasing the last article for comment and the page name and display photo was swiftly changed…

Nam & Ri movements

Pyongyang Papers believes that Nam, and her daughter Ri Son Chong traveled from Phnom Penh to Beijing in the middle of January and Nam’s plan is to head to Shenyang, then Dandong and then back to Beijing before finally traveling back to the DPRK! In our last investigation we noted how Nam had parted ways with her former business partner and was looking for a new partner to open a joint venture restaurant in China. With Nam planning to head back to the DPRK we are unsure where this leaves the plan for the joint venture restaurant in China. Maybe Nam has passed the plan onto another DPRK national in China. If you have any information on the status on the joint venture please get in touch via the ‘Contact Us’ page.

During our investigations, we have also uncovered that Nam Un Gyong also has another daughter – Ri Son Hwa. Ri Son Hwa attended a foreign university and currently works as a trading employee at the Rakwon Guidance Bureau. The Rakwon Guidance Bureau is believed to sit under ‘Room 39’, a secretive party organization which seeks to maintain foreign currency for the North Korean leaders.

It is well documented that ‘Room/Bureau 39’ is a secretive North Korean party organization that seeks ways to maintain the foreign currency slush fund for the country’s leaders

Luxury Goods

Investigations by Pyongyang Papers have also uncovered additional details about Nam Un Gyong and Ri Son Chong activities. It appears the duo were also involved in the luxury goods trade. We are aware of a deal involving both Ri Son Chong and Nam with a Thailand-based DPRK Korea Chilsongmun Trading Corporation (CTC) employee. Ri Son Chong and Nam have spent hundreds of thousands of $’s on alcohol, buying and exporting it from Cambodia to DPRK. Importing and exporting luxury goods to and from North Korea also contravenes UN sanctions, however it is widely known that Kim Jong Un is partial to unhealthy habits such as drinking and smoking. We wonder whether Ri Son Chong and Nam’s shipment is headed straight for their leader? Nam and Ri Son Chong also worked with individuals Heng Sovannary and Srey Pov, based in Cambodia, to export more alcohol to DPRK.

The purchasing of luxury goods isn’t limited to just alcohol as we believe that Ri Son Chong has been buying Tommy Hilfiger purses as gifts for friends on her return to the DPRK. We also know Ri Son Chong was looking into other high-end brands such as Bottega Veneta.

Moving Money

It is clear that both Nam and her daughters have the connections and know how to set up these trade deals but we have been questioning how Nam has managed to earn currency overseas as a North Korean citizen without raising suspicion from the banking authorities. Our investigations have uncovered that a Cambodian individual that worked for Nam at her restaurant allowed her to use their bank account to receive large amounts of money. This is a tried and tested method for North Koreans who are earning illicitly abroad.

We are glad to hear that the Cambodian authorities are enforcing sanctions, we hope that China will follow suit and end Nam and her daughters sanction evasion activity. However, based on some of our previous investigations- we aren’t that confident!

Pyongyang Papers will continue to investigate Nam’s sanction breaking activity- if you are aware of any information then please contact us.

DPRK continues to build presence in Zambia

Pyongyang Papers has been investigating more North Korean sanctions breaking activity aimed at making money in Africa. According to the UN security Council, North Korea is estimated to run annual deficit of between $500million and $1billion. This is the amount of hard currency that North Korea needs to earn abroad each year to fund the regime and its nuclear weapons and missile programs. Each year North Korea generates an estimated $100 million of this in Africa.

You can read our previous investigations revealing the Republic of Congo, Ghana and Nigeria’s involvement in UN sanction breaking. Our current investigation focuses on another African country – Zambia. As of March 2023, Multiple North Korean workers are continuing to work in a number of companies and disciplines within Zambia.

This contravenes UN Security Council Resolution 2270 which requires direct member states to expel all foreign nationals (including DPRK citizens) who are determined to be working on behalf of a designated entity or otherwise assisting in sanctions evasion, and also resolutions 2375 & 2397 which prohibits member states from providing work authorizations for DPRK nationals in their jurisdiction in connection with admission to their territories and included repatriation of DPRK nationals by December 2019.

Korea General Corporation for External Construction (KOGEN)

One of the companies using North Korean laborers in Zambia is the Korea General Corporation for External Construction (KOGEN) or (GENCO). KOGEN is advertised on Naenara, the official DPRK web portal, as a professional overseas construction company, sending skilled workers and highlighting completed projects in the UAE, Kuwait, Qatar, Yemen, Russia, Libya and Mongolia. It has also created local branches, such as Zambia. They also known to use the names Chammae Construction Ltd and Gold Pick Construction Ltd. The business listing for Gold Pick Construction Ltd even states that the “main engineering team is from Korea”.

A promotional poster from a Gold Pick Construction Ltd business listing

KOGEN is a well-known entity to the United Nations Panel of Experts. Whilst investigating banks created to support investment or trade with North Korea, the UN uncovered a Malaysian company – Malaysia Korea Partners (MKP). KOGEN is only one of 13 MKP linked companies in Zambia. Using North Korean laborers who were paid pittance, MKP earned hard currency through construction projects, mining, trade in contraband coal and provision of security services. KOGEN, the North Korean entity for which MKP was acting as a front company, offered its services in Equatorial Guinea and Cote d’Ivoire- and Nigeria as well.

Further investigation by the UN revealed that KOGEN’s activities were not limited to Africa. Evidence emerged of a joint venture in the UAE and of significant activity in Russia. From information provided by Zambia and further investigations by the Panel it has been concluded that KOGEN, like MKP, has links to Mansudae Overseas Project Group. Pyongyang Papers have previously investigated Mansudae Overseas Project Group for their involvement in construction projects across Africa.

Moksong Construction Company

Another company we have been informed is operating with North Korean workers in Zambia is Moksong Construction Company, which we believe to be the same entity as the company operating under the name Moksong Overseas Construction & Economic Technology Cooperation Company. In May, NK News released an article detailing Moksong Overseas Construction involvement in construction of a library in Lusaka, Zambia. According to the North Korean commerce website Manmulsang, Moksong has “agencies in several European and African countries to ensure prompt, satisfactory and comprehensive cooperation in the architectural technology on order.”

A copy of the Moksong listing from the Manmulsang website

Pyongyang papers are also aware of another three DPRK entities working in Zambia. These are: Medical Cooperation Delegation, Ecological Environment Technology Cooperation Delegation and DPRK Economic & Commercial Representative Office in Zambia. Our investigation into these companies is still ongoing- please contact us if you have any additional information of the companies listed.

Zambia has been a member of the United Nations since 1964 and have evidently assisted the UN Panel of Experts previously in their investigations into North Korean sanction breaking activity taking place within its borders. Unfortunately it clearly isn’t doing enough to uncover and disrupt the North Korean laborers that still reside and earn money for the DPRK regime. Zambia and other African countries need to seriously address sanctions evasion and attempt to stop the flow of funds back to North Korea. Funds that are being used by Kim Jong Un to develop, test and build weapons that can only ensure more instability in the region.

Nam Un Gyong and new beginnings in China

Pyongyang Papers recently reported on a restaurant called the Blue Flower located in Phnom Penh, Cambodia and is run by two North Koreans: Nam Un Gyong and her daughter Ri Son Chong. By running the restaurant Nam and Ri are violating UN Security Council resolution 2397, which prohibits North Korean citizens from working abroad. It is also widely known that the money made by North Korean’s abroad makes its way back to the Kim Jong Un regime and funds North Korea’s nuclear and ballistic missile program, one of many sources of contention between the rest of the world and North Korea.

Blue Flower restaurant employees escape police

In our last article we reported how Cambodian authorities had given orders for The Blue Flower restaurant to be closed down. It appears Nam did not listen to the warning, as in a dramatic turn of events, we have been informed that she had to secretly escape from the Blue Flower and that the DPRK staff narrowly avoided capture by the Cambodian authorities due to the constant police presence at the restaurant. Our sources tell us these North Korean employees have now left Cambodia.

Investigations have confirmed that the Blue Flower restaurant is now officially closed and the premises where the restaurant was located apparently trashed. As mentioned previously, the restaurant employed Cambodian nationals due to DPRK border closure. We understand that the Cambodian nationals have all been fired and reportedly left the area. The restaurant may have closed but this does not mean the money-making activities by Nam & Ri have stopped!

North Korean Restaurants in China

With the closure of the Blue Flower. Nam has parted ways with her former business partner, an individual named Pan Yong and is already looking for a new business partner to help her open a joint venture restaurant in China! Since the beginning of this year, despite sanctions being in place, it is reported that at least 10 restaurants and hotels staffed by Koreans have popped up in three Chinese cities. Now that the DPRK borders are slowly re-opening, we believe that many thousands of North Korean workers are returning home from China under a week-long quarantine after arriving in a number of locations, including Rason, Sinuiju and Sunan. The re-opening of the border has also included freight trains making the journey between the two countries again, with one specifically arriving in Sinuiju and returning back to Dandong 45 minutes later.

A view of the sino-Korean friendship bridge

Could this mean more DPRK workers are preparing to move to China to replace the returning workers? or is China finally observing UN Sanctions? Only time will tell but Pyongyang Papers has suspicion it won’t be China observing UN sanctions! Historically, the two sides of the border have agreed to work together to prevent illegal crossings between the Yalu River and Tumen River, with both countries providing their own guards and agreements around times people were able to make the crossing. China also forcibly returned over 500 North Koreans who had escaped to China back over the border.

Illegal workers bringing home souvenirs

It is also likely that the returning DPRK workers, who were sent abroad to work and earn for the regime, will bring a number of sanctioned items home with them, such as money and luxury goods. It appears the Blue Flower had a number of elaborate, expensive looking paintings throughout the restaurant and stocked a large amount of high-end alcohol. Pyongyang Papers wonders if the returning workers and return of freight movement will see an influx of other sanctioned items into North Korea.

One of the paintings from the Blue Flower restaurant

Pyongyang Papers will continue to investigate Nam & Ri as they look to continue their efforts in China to earn sanctioned revenue for the North Korean regime but it is clear that China has a major role to play in enforcing UN sanctions aimed at stopping funds reaching the DPRK and being used to advance its nuclear and ballistic missile program. This is especially relevant given the recent launch of North Korea’s first ‘spy’ satellite using ballistic missile technology.

If you have any further information on Nam Un Gyong, her daughter Ri Son Chong or any other North Korean sanctions evasion, please get in touch through the ‘Contact us’ page.