Insights from Internet Scanning and Open Source Intelligence
In 2018, Check Point published a deep dive into SiliVaccine, North Korea s homegrown antivirus, and found its scanning engine was built on stolen, decade-old Trend Micro code. Check Point also named two suspected authors: the North Korean state IT company known as PGI, and STS Tech-Serv. (https://research.checkpoint.com/2018/silivaccine-a-look-inside-north-koreas-anti-virus/) A new version of…
In 2017, a United Nations Panel of Experts submitted a report to the UN Security Council that identified Global Communications Co. (Glocom) a Malaysian defense company as a front company for the DPRK. According to the report, Glocom which is managed by Pan Systems Pyongyang Branch, an entity affiliated with the DPRK s Reconnaissance General Bureau Continue reading Hato Tsusin: A Long-Forgotten…
The North Korean embassy has been in the news lately, so it felt like a good time to finally write this up. A couple of weeks ago I was in London and stopped by my favorite embassy. I usually stop by whenever I m in town but this time was a little different, I packed my Continue reading Gunnersbury Avenue: Sniffing the DPRK Embassy s WiFi
Taking a break from fake DPRK companies for a while, there was some interesting activity that I recently noticed on 175.45.176.97. Between May 14th and May 17th, 175.45.176.97 a request to the root of the server returned a 302 and was redirecting to recoshield.com which appears to be a South Korean company that manufacturers paint Continue reading DPRK Captive Portal Infrastructure Found in…
If you haven t read part 1, you can read it here: https://nkinternet.com/2026/04/07/npm-malware-fake-devs-and-deepfake-videos-these-are-a-few-of-my-favorite-dprk-things/ In order to keep the first part of this short the plan was to break it into a series of smaller posts. However, within 7 days after publishing the last post most of the accounts were taken down. So what s left and what Continue…
What started as what I thought was going to be a quick look into a suspicious GitHub organization turned into a much deeper rabbit hole with an active npm backdoor, more than a dozen fake developer personas, and recruitment posts looking for overseas facilitators. Individually there s a lot of interesting pieces here but together they Continue reading npm Malware, Fake Devs, and Deepfake Videos:…
An email discovered last year that was sent from North Korea’s internet infrastructure offers a rare look at how DPRK software developers market their work abroad. While most recent reporting has focused on North Korean IT workers fraudulently obtaining jobs at Western companies, the documents attached to this message appear to represent something different: a Continue reading Made for Export:…
Over the years I ve come across a number of sources and log files that provides some insight into what is on North Korea s Kwangmyong. If you re not familiar, North Korea has an intranet inside the country which is what most people access. I ve cleaned up my notes and started putting down everything that I have Continue reading Kwangmyong
A recent post by Hudson Rock detailed information derived from infostealer logs tied to activity associated with the Trevor Greer persona, you know the one trevorgreer9312@gmail[.]com. That write up provides some context around the data and places it with broader reporting on North Korean IT worker activity. If you haven t seen it, the article can Continue reading Additional Notes on the Trevor…
Before we go any further, one thing that I want to make clear is that the word assume is going to be doing some heavy lifting throughout this post. This was a rabbit hole that I recently went down and I probably have more questions than answers, but I still wanted to document what I Continue reading Hunting For North Korean Fiber Optic Cables
