Network Analysis Links Infrastructure to Suspected DPRK Fake IT Workers
Summary
A 30-day analysis of network activity around two IPs linked to luckyguys[.]site found VPN use, residential connections, and activity associated with freelance work. Traffic fell sharply after public exposure, consistent with infrastructure abandonment.
Key points
- The investigation examined 30 days of activity related to luckyguys[.]site, which was reported as linked to payments associated with DPRK-linked fake IT workers.
- The domain resolved to 163.245.219[.]19; analysis of related certificates uncovered a second IP, 216.158.225[.]144.
- VPN connections to the first IP were concentrated on Astrill (37.5%) and Mullvad (32.25%), with Proton VPN accounting for 6.25%.
- Residential IPs in the United States and Latvia connected to the infrastructure and showed activity involving VPNs and services including Gmail, ChatGPT, and Workana.
- Traffic to both IPs dropped sharply after public exposure, which the report assesses as consistent with infrastructure abandonment.
- The researchers say the combined telemetry suggests a distributed network of remote workers or facilitators and overlap with known DPRK fake IT worker tradecraft.
- Organizations are advised to review traffic to both IPs and assess hiring and network-monitoring risks involving residential proxies and freelance platforms.
Article Details
- Attack Vectors
- DPRK-linked fake IT workers reportedly use freelance hiring platforms such as Workana to seek remote employment under false identities.
- Residential IP addresses and VPN or proxy-hosting behavior may support the observed infrastructure or conceal its operators.
- Defensive Notes
- Treat residential IP addresses as potentially part of proxy or laundering networks rather than inherently trustworthy.
- Consider VPN overlap, particularly with providers previously associated with DPRK activity, as a risk signal.
- Monitor behavioral patterns as well as indicators, and review network traffic to 216.158.225[.]144 and 163.245.219[.]19.
- Apply additional scrutiny to residential IPs exhibiting proxy-hosting behavior, including proxyline usage.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | luckyguys[.]site | Domain linked in the report to payments associated with DPRK-linked fake IT workers and used to identify related infrastructure. |
| IPV4 | 163[.]245[.]219[.]19 | IP resolving from the reported infrastructure domain and identified for monitoring as associated infrastructure. |
| IPV4 | 216[.]158[.]225[.]144 | Additional IP identified through certificates named luckyguys[.]site and associated with the reported infrastructure. |