Bells Ringing in Dar es Salaam

# Bells Inter Trading Ltd.

We now have two personas that we believe are North Korean IT Workers, but what is the company that bonds them together, Bells Inter Trading Ltd? A quick google search for "Bells Inter Trading" turns up several interesting results showing that it appears to be a company name of an Apple App Store publisher, with two apps: Tiles Matching and Swift VPN, and secondly that it appears to be a business based in Dar Es Salaam, Tanzania associated with some work permits.

Based on what we know about Lian Hung, this information adds up, but what are these work permits?

In Tanzania, granted and rejected work permits for foreigners are published publicly to kazi.go.tz. Our google search for Bells Inter Trading pulled up one of these listing the following individuals as having applied for work permits using the following companies as their employer:

Since we didn't get any additional hits on BELLS INTER TRADING LIMITED, we decided collect all of the publicly available work permit documents and pivot off of applicant names and run them through OCR. At the end, we identified 9 individuals, all with Korean names (sometimes variations of the same names, or with single letter changes), working at BELLS INTER TRADING LIMITED. Additionally, we identified that some of these individuals had also worked at two other companies, which we have even less information about: FAMM (AMTL) CO Ltd. and MULIKA DEVELOPMENT FOUNDATION:

Associated Individuals:

We believe it is highly likely that BELLS INTER TRADING LIMITED is a North Korean run front company employing IT Workers in Tanzania. Although Tanzania, and Africa in general, is not commonly known to be associated with the DPRK -- countries across the African continent, including Tanzania, have had good or great relations with North Korea throughout the nations history. In fact, during the Cold War some African countries instead opted for North Korean advisors or Soviets.

In one such example, seen in the same dataset that we found the workers associated with Bells Inter Trading, is a another suspected North Korean company: MAIBONG SUKIDAR MEDICAL CO. LTD, which was documented in a 2020 UN Council of Experts report. This company, associated with 51 different individuals, ran several medical clinics in Tanzania before being kicked out of the country after UN investigation.

The other two companies besides Bells (FAMM (AMTL) and Mulikda Development Foundation) had very little information online, however we found that FAMM (AMTL) is involved in gold mining and has appeared on several websites being accused of running 501 scams. Mulika Development Foundation was listed in several freelancers online portfolios claiming to be based out of India and Bangladesh.

# Millions on Millions.

So what is Bells Inter Trading doing in Tanzania? At least part of their operations, or at least Lian Hung, are focused on app development -- primarily mobile VPNs, which he has had a good amount of success with.

The first two apps directly tied to Bells Inter Trading are on Apple's App Store, SwiftVPN and Tiles Matching:

https://apps.apple.com/ie/app/tiles-matching/id6737127654
https://apps.apple.com/us/app/swift-vpn/id1612950256
					

Although the Apple App Store does not list the number of installs for an app, it does list the support email for these two as ayusuphmhina@gmail.com, which we have also observed Lian Hung logging into, in addition to a SwiftVPN admin panel.

Pivoting off this email opened a floodgate of different apps, primarily VPNs, that total around 12M+ total installs once we had finished pivoting:

Total: ~12,620,000 installs

Additionally, Lian Hung is associated with the following VPNs with much lower install rates or which were taken down from the app store (in the case of GulfGuard VPN, Google Play removed the app stating that the reasoning was due to malicious code/trojans):

Last, but not least, we identified 3 US-based IPv4-IP ranges registered to Bells Inter Trading Co. Ltd:

69.30.210.152 - 69.30.210.159 (WholeSale Internet - Kansas)
107.150.47.16 - 107.150.47.23 (Nocix LLC - Kansas)
173.208.245.144 - 173.208.245.151 (WholeSale Internet - Kansas)
					

Although we did not identify any interesting traffic originating from these ranges, if others do please contact us at chollima_group@proton.me.

# Closing Thoughts.

This is our second and final part documenting connections to DPRK actors related to Moonstone Sleet's DeTankZone operation. While Tanzania, and Africa more broadly, has not been widely recognized as the hotbed of North Korean activity that it is, we hope that this analysis contributes to better understanding DPRK operations there.

North Korean entities operate illicitly around the world, often thriving in the underbelly of the global economy where many are not paying attention. Bells Inter Trading is only one such example.

North Korean corporations and organizations, such as Haegumgang Trading Corporation (which has historically operated in this area), often establish front companies very similar to Bells Inter Trading in the lesser-scrutinized areas of the world. These companies, operating in structures most comparable to organized crime families, a concept best outlined in DTEX's "Exposing the DPRK's Cyber Syndicate" report, then bring on IT Workers such as Lian Hung to generate additional revenue for the company to sustain itself.

We believe that this is an important consideration to make regarding IT Workers, who are commonly misunderstood as a single-unified threat group. Rather than viewing them as a monolithic entity, North Korean IT Workers are more akin to individual entrepreneurs operating under the blessing of a higher-status boss. These bosses are often themselves working under the banner of a larger company or organization subservient to a DPRK government bureau, agency, or the KPA. As an IT Worker gains more status and respect, they are able to climb the organization's ranks and eventually become bosses themselves. From there they may form their own front companies and gain the status necessary to take on more malicious activity (if they so choose). We believe Lian Hung and Hailong Jin, both appearing to be in their 30s-40s, may be operating as middle managers or hold higher statuses in this structure, which may explain their titles of choice being "Project Manager".

This structure is precisely why we believe that understanding the IT Workers as a single threat is a significant mistake and why we believe that there should be more effort placed on investigating unique activity clusters. The IT Workers are an ecosystem, and in order to better understand them, comprehend their associated risk levels, and ultimately counter them, it is important to identify how they fit into the larger North Korean economy and how the broader IT ecosystem that they are a part of functions. The North Korean in Rason trying to get hired at your enterprise is part of the same ecosystem as the North Korean in Tanzania picking up jobs on UpWork, the Andariel operator ransoming a hospital, and the Solidity developer in Laos who just stole millions from another blockchain project.

Recognizing the interconnected nature of North Korean cyber operations, and framing it as an ecosystem that varies from low-level IT workers to sophisticated APT groups, is crucial for developing more effective countermeasures and attribution frameworks. Only by understanding the full scope of this ecosystem can we hope to learn from it and meaningfully disrupt it.

# IOCs.

Lian Hung:
----------------------------------------
Emails:
ayusuphmhina@gmail.com
lianhung21@hotmail.com
lianhung21@gmail.com
mano12@gmail.com
liuqimi21@gmail.com
alex@bellsstudio.site
libfredrick@gmail.com
michaeldein243@gmail.com
josephdgray211@hotmail.com
marogus211@outlook.com
briandwingo55@yahoo.com
silverbeach613@gmail.com
wilsonliuq2111@outlook.com
munjin22@gmail.com
guangheli211@gmail.com
wilsondovi21@gmail.com
asemenovboyarka@gmail.com
alex@bellsstudio.site
freeserviceexpert@gmail.com
sadah12290@gmail.com
leoxtechdev@gmail.com
goldenharvestmidas@gmail.com

Sites:
marogus211.wixsite.com
youtube.com/@liberathachannel
linkedin.com/in/lian-hung-129b47158
smart.5starlink.online
facebook.com/LeoXTech

IPs:
102.215.28.11

Hailong Jin:
----------------------------------------
Personas:
Hailong Jin
Gabriel Rodrigues de Souza
Volodymyr Yakubovskyi

Emails:
goldsea808@gmail.com
goldsea808@yahoo.com
ddksniper@gmail.com

Sites:
linkedin.com/in/hailong-jin-906375118
facebook.com/profile.php?id=100083340646764
youtube.com/@jackddk7187
global808.wixsite.com
our-dream-technologies.vercel.app


intellichain555:
----------------------------------------
Emails:
intellichain555@gmail.com
chainerspace@gmail.com
fullasher@gmail.com
cyberos999@gmail.com
odincui@gmail.com
sunnykan314@gmail.com
salbu15154@gmail.com
salbuvabybit@hotmail.com
mykytadunaiev@outlook.com
moktamd3@gmail.com

Sites:
github.com/intellichain555


Bells Inter Trading:
----------------------------------------
Sites:
bellastudio.online
bellsstudio.site

IPs:
69.30.210.152 - 69.30.210.159
107.150.47.16 - 107.150.47.23
173.208.245.144 - 173.208.245.151


VPNs:
----------------------------------------
https://apps.apple.com/us/app/swift-vpn/id1612950256
https://apps.apple.com/ie/app/tiles-matching/id6737127654
https://play.google.com/store/apps/details?id=com.free.stealthvpn&hl=en-US
https://play.google.com/store/apps/details?id=com.freevpn.fastvpn&hl=en-US
https://play.google.com/store/apps/details?id=com.freevpn.oryxvpn&hl=en
https://play.google.com/store/apps/details?id=com.fastvpn.dreamvpn&hl=en
https://www.ldplayer.net/games/tiles-matching-travel-puzzle-on-pc.html
https://play.google.com/store/apps/details?id=com.halleyvpn.freevpn&hl=en_US
https://play.google.com/store/apps/details?id=com.ace.freevpn&hl=es_US
https://play.google.com/store/apps/details?id=app.swift.uaevpn&hl=es_US
https://play.google.com/store/apps/details?id=com.freevpn.smartvpn&hl=es_US
https://shot-vpn-unlimited-free-vpn-proxy.en.softonic.com/android
https://play.google.com/store/apps/details?id=com.fastvpn.dreamvpn&hl=en
https://apkcombo.com/ultraconnect-vpn/com.ultraconnect.ultraconnectvpn/
https://apkpure.com/guardian-vpn/app.star.guardianvpn/download