Sekoia and Kudelski Map North Korea’s Cyber Operations and Supporting Networks
Summary
A joint Sekoia and Kudelski report maps North Korea’s cyber institutions, APT clusters, IT-worker operations, and overseas enablers, describing how espionage and cybercrime support sanctions evasion and regime revenue.
Key points
- The report describes cyber operations as a strategic tool for espionage, sanctions evasion, and revenue generation, including funding for weapons programs.
- It maps offensive cyber capabilities primarily to the GRIB, formerly the RGB, and links Reaper to the NIA, formerly the MSS.
- The researchers split the former Lazarus umbrella into six sub-clusters: TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima.
- Thousands of North Korean IT workers reportedly use false identities to secure overseas jobs, remit earnings, and potentially exploit insider access.
- The report identifies overlap between IT-worker infrastructure and offensive campaigns, including shared VPN exit nodes.
- Overseas universities, front companies, relay networks, and criminal intermediaries help support operations and launder proceeds.
- Frequent institutional reorganizations and overlap between espionage and revenue-generating activity complicate tracking the threat.
Article Details
- Publisher
- Sekoia and Kudelski Security
- Scope
- DPRK offensive cyber institutions, intrusion clusters, IT worker operations, and supporting educational, infrastructure, and money-laundering networks.
- Key Statistics
- Sekoia and Kudelski Security divide the former Lazarus umbrella into six distinct sub-clusters.
- The report estimates that thousands of DPRK IT workers operate within and beyond the country's borders; no precise count is supplied.
- The report cites the 2025 Bybit theft as involving $1.5 billion.
- At least 19 Chinese banks reportedly have been used to launder funds in the context of DPRK-linked operations.
- An estimated $37.6 million in North Korea-linked cryptocurrency was laundered through Cambodia-based Huione Group between 2021 and 2025.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]214[.]44[.]138 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with Contagious Interview infrastructure, citing Recorded Future. |
| IPV4 | 167[.]88[.]61[.]117 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with Contagious Interview infrastructure, citing Recorded Future. |
| IPV4 | 185[.]135[.]76[.]89 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with Contagious Interview infrastructure, citing Recorded Future. |
| IPV4 | 188[.]43[.]33[.]252 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with Contagious Interview infrastructure, citing Recorded Future. |
| IPV4 | 211[.]21[.]6[.]181 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with Contagious Interview infrastructure, citing Recorded Future. |
| IPV4 | 23[.]237[.]102[.]130 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with Contagious Interview infrastructure, citing Recorded Future. |
| IPV4 | 37[.]120[.]154[.]98 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with Contagious Interview infrastructure, citing Recorded Future. |
| IPV4 | 38[.]75[.]137[.]97 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with Contagious Interview infrastructure, citing Recorded Future. |
| IPV4 | 45[.]86[.]208[.]162 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with Contagious Interview infrastructure, citing Recorded Future. |
| IPV4 | 50[.]7[.]159[.]34 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with Contagious Interview infrastructure, citing Recorded Future. |
| IPV4 | 66[.]118[.]255[.]35 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with the Bybit attack, citing Silent Push. |
| IPV4 | 70[.]32[.]3[.]15 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with Contagious Interview infrastructure, citing SentinelOne. |
| IPV4 | 91[.]239[.]130[.]102 | Annex 2 identifies this as a DPRK fake IT worker exit node overlapping with Contagious Interview infrastructure, citing Recorded Future. |
MITRE ATT&CK
T1090 · ProxyDPRK operators use overseas relay networks, VPN exit nodes, and third-party laptop proxies to conceal their operating location.T1485 · Data DestructionThe report describes destructive wiper operations and APT38's use of KillDisk disk wiping as an anti-forensics measure in 2017.T1486 · Data Encrypted for ImpactAndariel and Moonstone Sleet reportedly deployed ransomware in financially motivated operations.
People
Alexander KozlovCo-chair of the intergovernmental commission of the Russian Federation and North Korea, cited regarding North Korean admissions to Russian universities.CliffordListed as an article author.Coline C.Listed as an article author.Kim Jong-ilReportedly prioritized electronic warfare and described cyberattacks as atomic bombs of the information age.Kim Jong-unDPRK leader described as directing strategic priorities, overseeing intelligence institutions, and reinforcing cyber operations as a strategic and revenue-generating capability.Saee V.Listed as an article author.
Threat Actors
AndarielDPRK cluster with espionage and revenue-generation mandates; reportedly used Maui and H0lyGh0st and collaborated with Play in 2024.APT38Financially motivated DPRK cluster associated with the 110th Research Institute; assessed as likely subsequently split into CryptoCore and Jade Sleet.Bureau 121Its operatives were allegedly responsible for the 2014 Sony hack and were speculated to have operated from Chilbosan Hotel in China.Citrine SleetOne of six sub-clusters into which Sekoia and Kudelski Security divide the former Lazarus umbrella.CryptoCoreFinancially motivated Lazarus sub-cluster; the researchers assess that APT38 likely split into CryptoCore and Jade Sleet.Famous ChollimaLazarus sub-cluster representing malicious activity related to fake IT workers, often supporting other cyber warfare units.GRIBDPRK intelligence bureau commanding offensive cyber units; the report identifies it as the renamed RGB.Jade SleetFinancially motivated Lazarus sub-cluster; the researchers assess that APT38 likely split into CryptoCore and Jade Sleet.KimsukyGRIB-associated espionage cluster; some DPRK experts regard it as a mega-cluster containing branches including TA406 and TA408.Lazarus GroupHistorical DPRK intrusion umbrella that the researchers divide into six sub-clusters; associated with espionage, sabotage, financial theft, and laundering investigations.Moonstone SleetDual-mandate DPRK cluster reportedly deploying FakePenny in 2024 and Qilin ransomware-as-a-service in 2025.MSSFormer name of NIA; described as conducting cyber operations targeting defectors and DPRK experts.NIADPRK intelligence agency associated with cyber operations against defectors and foreign targets; formerly MSS.PlayRansomware actor with which Andariel reportedly collaborated in 2024.ReaperGenerally associated with NIA; targets defectors, activists, NGOs, experts, and public and private entities, mainly in South Korea.RGBFormer name of GRIB, the DPRK intelligence bureau associated with offensive cyber units.TA406Described by some DPRK experts as a branch within the Kimsuky mega-cluster.TA408Described by some DPRK experts as a branch within the Kimsuky mega-cluster.TEMP.HermitOne of six sub-clusters into which Sekoia and Kudelski Security divide the former Lazarus umbrella.
Malware
FakePennyPlay in 2024. Another DPRK cluster, Moonstone Sleet, acted similarly by deploying its custom malware FakePenny in 2024, but also the Qilin RaaS in 2025. It is interesting to note that the two clusters integratedH0lyGh0stOf note, Andariel is particular as it used custom ransomware (Maui and H0lyGh0st) for financial theft, as well as ransomware-as-a-service (RaaS) developed by an operator of the Russian cybercrime ecosystem. It wasKillDiskand Jade Sleet, which was a financially-motivated threat cluster, which leveraged disk-wipe techniques (KillDisk) as an anti-forensics measure in 2017.MauiOf note, Andariel is particular as it used custom ransomware (Maui and H0lyGh0st) for financial theft, as well as ransomware-as-a-service (RaaS) developed by an operator of the Russian cybercrime ecosystem. It wasQilincluster, Moonstone Sleet, acted similarly by deploying its custom malware FakePenny in 2024, but also the Qilin RaaS in 2025. It is interesting to note that the two clusters integrated RaaS in their campaigns withinWannaCryof first DPRK-led destructive cyber operations (Operation DarkSeoul 2013, Sony PIctures Hack 2014, WannaCry 2017), the multiplication of intelligence gathering operations, and the systematic use of cyber
Products
Countries
Cambodiaand cryptocurrency exchanges with high-volume cash conversion channels in Myanmar, Thailand, Laos, and Cambodia have served as key operational nodes for money laundering. Chinaand function as operational nodes. This parallel web of third-country relays often extends to allies like China and Russia, as well as countries in Africa and Southeast Asia. Front companies across these regionsDPRKBeyond Lazarus: Organization of DPRK cyber capabilitiesGuineain countries like Tanzania. According to the Chollima group, DPRK operatives are also likely deployed in Guinea and Nigeria through similar fronts.Laosthe generation of illicit revenue abroad. Chinyong’s teams are primarily known to operate out of China, Laos, and Russia, where they engage in “traditional” freelance IT work, as well as in cryptocurrency theftMyanmaractors. In particular, casinos and cryptocurrency exchanges with high-volume cash conversion channels in Myanmar, Thailand, Laos, and Cambodia have served as key operational nodes for money laundering. Nigerialike Tanzania. According to the Chollima group, DPRK operatives are also likely deployed in Guinea and Nigeria through similar fronts.Russiaas operational nodes. This parallel web of third-country relays often extends to allies like China and Russia, as well as countries in Africa and Southeast Asia. Front companies across these regions participate inSouth Koreadismantled unification-oriented institutions and revised the constitution in 2026 to define South Korea as foreign territory rather than a temporarily separated part of the same nation. This shift reflectsTanzaniacompanies such as Junggongchon Trading Corporation are known to deploy IT worker teams in countries like Tanzania. According to the Chollima group, DPRK operatives are also likely deployed in Guinea and Nigeria throughThailandparticular, casinos and cryptocurrency exchanges with high-volume cash conversion channels in Myanmar, Thailand, Laos, and Cambodia have served as key operational nodes for money laundering. United Statesdeniable, and effective against wealthier and more networked states, such as South Korea and the United States, they became a natural extension of the asymmetric-deterrence line of DPRK.
Industries
Cryptocurrencyevolved from espionage and sabotage into a load-bearing revenue stream, bank heists, ransomware, and cryptocurrency theft, financing the very weapons programmes that international sanctions were designed to constrain.Defensestate-owned defense conglomerate designated under UN andEducationwhich serve a dual purpose. They train the DPRK's cyber operatives, and, in the later stages of education, they function as operational nodes for offensive activity, particularly when located in alliedfinancialOf note, Andariel is particular as it used custom ransomware (Maui and H0lyGh0st) for financial theft, as well as ransomware-as-a-service (RaaS) developed by an operator of the Russian cybercrime ecosystem. It wasGamblingCambodia, in particular, has emerged as a laundering hub due to its less regulated financial and gambling sectors, with an estimated $37.6 million in North Korea-linked cryptocurrency laundered between 2021 and 2025ITGet the full overview of North Korea's cyber operations, from state institutions and APT clusters to IT workers units, and enablers.