← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
31,188
Relationships
34,074
Potential duplicates
0
Filter by kind
Entities
↯30515ab4
SEC voluntarily dismisses remaining civil enforcement actions against ZM Quant Investment Ltd. (including Baijun Ou and Ruiqi Lau) and against Andrey Zhorzhes in the CLS Global civil matter, as part of broader administration policy shift. DOJ criminal proceedings are unaffected.(2026-03-31:cls-global-zm-quant)event
↯0127a300
U.S. District Court for the District of Massachusetts enters consent final judgment in the SEC civil case against CLS Global FZC LLC: $425,000 civil penalty, $3,000 disgorgement, $80.39 prejudgment interest, and permanent injunctions from future violations.(2025-04-07:cls-global-zm-quant)event
↯587d8b9c
Boston federal court finalizes CLS Global's criminal sentencing: $428,059 total payment, three-year probation, prohibition from U.S. cryptocurrency markets.(2025-04-02:cls-global-zm-quant)event
↯a5efed44
DOJ announces CLS Global FZC LLC has agreed to plead guilty to one count of conspiracy to commit market manipulation and wire fraud and one count of wire fraud.(2025-01-21:cls-global-zm-quant)event
↯01372eb7
DOJ publicly announces Operation Token Mirrors charges. SEC files civil fraud charges against CLS Global, ZM Quant, Gotbit, and named individuals under Press Release 2024-166. Indictments unsealed.(2024-10-09:cls-global-zm-quant)event
↯e31cdb88
Federal grand jury in Boston returns sealed superseding indictment against ZM Quant Investment Ltd., Baijun Ou, and Ruiqi Lau (case 1:24-cr-10187). CLS Global and Andrey Zhorzhes separately indicted (case 1:24-cr-10293).(2024-09-19:cls-global-zm-quant)event
↯e848d95f
CLS Global's NexFundAI manipulation window ends. Total artificial volume generated: approximately $595,000, representing 98% of all NexFundAI trading activity during the period.(2024-09-18:cls-global-zm-quant)event
↯626a392b
CLS Global begins conducting manipulative wash trades for NexFundAI on Uniswap.(2024-08-23:cls-global-zm-quant)event
↯24e9b6ae
Undercover FBI agents begin video teleconferences with CLS Global. Employee Andrey Zhorzhes joins a Telegram group with undercover operatives posing as NexFundAI promoters and describes the firm's wash trading algorithm.(2024-07-01:cls-global-zm-quant)event
↯4ba75547
ZM Quant generates approximately $4,600 in artificial NexFundAI trading volume on Uniswap over nine hours, representing 83.6% of the token's trading activity during that period.(2024-05-31:cls-global-zm-quant)event
↯a0517c5e
Undercover FBI operatives conduct a video teleconference with ZM Quant employees Baijun Ou and Ruiqi Lau, who describe multi-wallet wash trading methodology for NexFundAI token.(2024-03-01:cls-global-zm-quant)event
↯5dcbf6f9
ZM Quant alleged to have executed SaitaRealty trades increasing the token's transaction quantity by approximately 412,000,000,000% within 24 hours following exchange warnings about low volume.(2023-05-26:cls-global-zm-quant)event
↯cec4a73b
ZM Quant alleged to have begun wash trading for Saitama Inu (SAITAMA) token on behalf of promoters (approximate start date per SEC complaint).(2021-09-01:cls-global-zm-quant)event
↯7f79b837
CLS Global FZC LLC founded in Dubai, UAE. ZM Quant Investment Ltd. begins crypto market-making operations from British Virgin Islands, with Hong Kong-based personnel.(2018-01-01:cls-global-zm-quant)event
↯c4d99fc8
CrowdStrike reports DPRK-linked cyber groups stole a combined $2.02 billion in 2025 (up 51% year-over-year); financial services identified as an escalating target sector.(2026-05-14:dprk-it-worker-network-overseas-scheme)event
↯26c2fac1
Kejia Wang sentenced to 108 months in prison and Zhenxing Wang sentenced to 92 months in prison for operating laptop farms for DPRK IT workers, generating more than $5 million for the regime using stolen identities of 80+ U.S. citizens.(2026-04-16:dprk-it-worker-network-overseas-scheme)event
↯a88ff143
OFAC designates six individuals and two entities (Amnokgang Technology Development Company; Quangvietdnbg International Services Company Limited) for roles in generating approximately $800 million in 2024 for DPRK weapons programs. Twenty-one cryptocurrency addresses across Ethereum, Tron, and Bitcoin identified.(2026-03-12:dprk-it-worker-network-overseas-scheme)event
↯7ca7823a
OFAC designates Russian national Vitaliy Sergeyevich Andreyev, Shenyang Geumpungri Network Technology Co. (China), and Korea Sinjin Trading Corporation (DPRK) for facilitating payments to Chinyong IT worker network.(2025-08-27:dprk-it-worker-network-overseas-scheme)event
↯e642b6ce
CrowdStrike reports North Korean IT worker infiltration attempts grew 220% year-over-year; AI is weaponized at every stage of the hiring process including deepfakes and synthetic identity generation.(2025-08-04:dprk-it-worker-network-overseas-scheme)event
↯958cac87
DOJ files civil forfeiture complaint against $7.74 million in cryptocurrency tied to Sim Hyon Sop's laundering network.(2025-06-05:dprk-it-worker-network-overseas-scheme)event
↯9398a3ea
DOJ announces coordinated nationwide enforcement: two new indictments, one information with plea, arrest of Zhenxing Wang in New Jersey. FBI executes searches of 21 premises across 14 states hosting laptop farms (June 10–17). Seizure of 29 financial accounts and 21 fraudulent websites.(2025-06-10:dprk-it-worker-network-overseas-scheme)event
↯72534535
FBI IC3 issues public service announcement warning companies of data extortion by North Korean IT workers leveraging unauthorized corporate network access.(2025-01-23:dprk-it-worker-network-overseas-scheme)event
↯67caacf7
DOJ indicts North Korean nationals Jin Sung-Il and Pak Jin-Song plus three facilitators for placing workers at 64 U.S. companies between 2018 and 2024, generating at least $866,255 in illicit revenue laundered through a Chinese bank account.(2025-01-21:dprk-it-worker-network-overseas-scheme)event
↯765898e9
DOJ indicts 14 North Korean nationals (including Yanbian Silverstar CEO Jong Song Hwa, Kim Ryu Song, Ri Kyong Sik) for $88 million IT worker fraud scheme over six years. State Department simultaneously offers $5 million Rewards for Justice bounty on the companies.(2024-12-11:dprk-it-worker-network-overseas-scheme)event
↯fbdbba33
Google/Mandiant documents sharp increase in extortion attempts by DPRK IT workers, coinciding with increased law enforcement pressure. Workers begin targeting larger organizations.(2024-10-01:dprk-it-worker-network-overseas-scheme)event
↯9a1cff88
DOJ arrests Nashville-based facilitator Matthew Isaac Knoot; disrupts North Korean remote IT worker fraud schemes. Seizures of related financial accounts.(2024-08-01:dprk-it-worker-network-overseas-scheme)event
↯45272a17
DOJ launches DPRK RevGen: Domestic Enabler Initiative under National Security Division and FBI Cyber and Counterintelligence Divisions, specifically targeting U.S.-based laptop farm operators.(2024-03-01:dprk-it-worker-network-overseas-scheme)event
↯0a37142a
Sim Hyon Sop indicted for conspiring with DPRK IT workers to generate revenue and with OTC crypto traders to launder funds; $7.74 million restrained by U.S. government.(2023-04-01:dprk-it-worker-network-overseas-scheme)event
↯5ad9968a
OFAC publishes advisory on North Korea IT Workers; first U.S. government public warning to the private sector.(2022-05-16:dprk-it-worker-network-overseas-scheme)event
↯427ebaa4
Second cohort of DPRK IT workers (Jin Sung-Il, Pak Jin-Song network) begins placing workers at U.S. companies under stolen U.S. passport identities (approximate start date per DOJ indictment).(2018-04-01:dprk-it-worker-network-overseas-scheme)event
↯25c5c4bc
Yanbian Silverstar and Volasys Silver Star begin operating; DPRK IT workers placed in U.S. companies under false identities (approximate start date per DOJ indictment).(2017-04-01:dprk-it-worker-network-overseas-scheme)event
□3e5d5e80
DPRK IT Worker Network (Overseas Scheme)organization
◎59074913
securelist.comdomain
◎d586e9b4
attack.mitre.orgdomain
↯e0d2ab2c
Drift Protocol publishes post-mortem attributing attack to UNC4736 (Citrine Sleet) with medium confidence based on on-chain fund flows to Radiant Capital addresses. Mandiant and law enforcement engaged.(2026-04-05:citrine-sleet-applejeus)event
↯be001b93
Attackers execute durable nonce attack on Drift Protocol using pre-signed multisig transactions dormant for over one week, draining approximately $285 million in user assets in roughly twelve minutes. Telegram channels and malware are immediately deleted.(2026-04-01:citrine-sleet-applejeus)event
↯96a99ab5
Drift operatives continue in-person meetings with contributors across multiple countries, sharing malicious links and ultimately compromising contributor devices via malicious VSCode project (tasks.json exploit) and a TestFlight iOS application.(2026-02-01:citrine-sleet-applejeus)event
↯0743d45f
Attackers onboard an Ecosystem Vault on Drift Protocol, depositing over $1 million in real capital to establish legitimacy and begin formal integration discussions.(2025-12-01:citrine-sleet-applejeus)event
↯44e5e2cc
Citrine Sleet operatives begin approaching Drift Protocol contributors at major cryptocurrency conferences, presenting as employees of a quantitative trading firm. Six-month social engineering operation commences.(2025-10-01:citrine-sleet-applejeus)event
↯82151b85
Radiant Capital publicly attributes the October 2024 $50 million exploit to UNC4736 (Citrine Sleet) following Mandiant investigation.(2024-12-09:citrine-sleet-applejeus)event
↯349e0e46
UNC4736 (Citrine Sleet) exploits compromised Radiant Capital developer devices to drain approximately $50 million from the cross-chain DeFi protocol. Three developers' multisig keys are used to approve fraudulent transactions.(2024-10-16:citrine-sleet-applejeus)event
↯f8946b28
Palo Alto Networks Unit 42 publishes Gleaming Pisces / PondRAT poisoned Python packages campaign analysis.(2024-09-01:citrine-sleet-applejeus)event
↯bf55f1b2
UNC4736 operatives send malicious ZIP file via Telegram to Radiant Capital developers, impersonating a former contractor and delivering INLETDRIFT macOS backdoor inside a PDF.(2024-09-11:citrine-sleet-applejeus)event
↯6a2cd96d
Microsoft publicly publishes Citrine Sleet CVE-2024-7971 / FudModule rootkit analysis.(2024-08-30:citrine-sleet-applejeus)event
↯0352d178
Google releases Chrome patch for CVE-2024-7971.(2024-08-21:citrine-sleet-applejeus)event
↯f107cf26
Microsoft identifies Citrine Sleet actively exploiting Chromium zero-day CVE-2024-7971 (V8 type confusion, CVSS 8.8) to deliver FudModule rootkit via exploit domain voyagorclub[.]space.(2024-08-19:citrine-sleet-applejeus)event
↯5187146e
Microsoft patches CVE-2024-38106 (Windows kernel vulnerability) as part of August Patch Tuesday.(2024-08-13:citrine-sleet-applejeus)event
↯0ddbdde2
Malicious Python packages (real-ids, coloredtxt, beautifultext, minisound) containing PondRAT backdoor uploaded to PyPI, attributed to Gleaming Pisces (Citrine Sleet) by Palo Alto Networks Unit 42.(2024-02-01:citrine-sleet-applejeus)event
↯57947f36
Mandiant publishes full 3CX supply chain compromise analysis, attributing the cascading attack to UNC4736 with high confidence of North Korean nexus.(2023-04-20:citrine-sleet-applejeus)event
Data refreshes within about 10 minutes · All metrics derived from Supabase