Hudson Rock Links DPRK Operator to Polyfill.io Attack Through Infostealer Forensics
Summary
Hudson Rock says LummaC2 data from an infected workstation links a suspected DPRK operator to Funnull’s Polyfill[.]io operation and indicates access to Gate[.]us, LR Techs and NIMS systems, based on recovered browser, credential and autofill telemetry.
Key points
- Hudson Rock reports that LummaC2 data from an infected workstation included more than 100 credentials, over 7,000 browsing logs, autofill records and Cloudflare administrator access.
- The report says the infection followed a download of a password-protected archive disguised as a software installer from MediaFire.
- Hudson Rock links credentials for Funnull’s DNS portal and a Cloudflare tenant to the same endpoint; it cites translated chat logs discussing Polyfill domain changes, DNS routing and concealing injected code in a GoEdge build.
- The article says the operator used the alias “Ariel Cruz” to access Gate[.]us compliance workflows and examine Sumsub KYC checks; these findings are attributed to Hudson Rock’s analysis.
- Hudson Rock interprets Google Workspace autofill records as evidence that the operator copied NIMS closed-network infrastructure documents, and reports credentials associated with LR Techs and its downstream access.
- The report also describes credentials for Stark Industries Solutions and an alleged Telegram-based USDT payment gateway, which it connects to DPRK-linked operations.
- Its defensive recommendations include reviewing unusual time-zone or latency patterns and investigating high volumes of translation queries alongside sensitive document-copy activity.
Article Details
- Attack Vectors
- The report says the operator infected their workstation after downloading and opening a password-protected, trojanized software archive from a MediaFire link; LummaC2 then exposed browser data and credentials.
- The report attributes the Polyfill.io supply-chain compromise to malicious JavaScript injected through Funnull-managed CDN infrastructure, redirecting mobile visitors to scam and gambling sites.
- The operator allegedly used synthetic identities, including the persona “Ariel Cruz,” to gain access to Gate.us and participate in compliance workflows.
- Credentials recovered from the infected endpoint reportedly enabled access to Funnull DNS administration, a Cloudflare tenant, and LR Techs workspaces and cloud accounts.
- The report says the operator copied sensitive NIMS network-architecture documents from Google Workspace to a private drive, and used LR Techs access to reach downstream Japanese enterprise clients.
- The operator reportedly built a Telegram-based payment gateway to automate USDT laundering and the leasing of poisoned CDN nodes.
- Defensive Notes
- The article recommends behavioral analytics for remote contractors, including auditing latency and IP patterns and checking whether activity consistently aligns with time zones inconsistent with an employee’s stated location.
- Monitor for unusual volumes of Google Translate activity paired with Google Workspace “Make a copy” events involving sensitive documents, network diagrams, or personal data.
- The article recommends stronger contractor identity verification and behavioral monitoring rather than relying on identity checks alone.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cctest[.]kk5yuzmev2qbgulz[.]com | Funnull-related test domain that the report says shares infrastructure with the DNS management domain. |
| DOMAIN | polyfill[.]com | Domain named in the reported Funnull communications about changing Polyfill domains and DNS routing during the attack. |
| DOMAIN | polyfill[.]io | The report identifies the domain as compromised and used to distribute malicious JavaScript in the supply-chain attack. |
| DOMAIN | polyfillcache[.]com | Replacement domain named in the reported Funnull communications about changing Polyfill domains during the attack. |
| DOMAIN | t2[.]funnull[.]host | Funnull infrastructure identified in the report as the reverse-PTR destination for related DNS-management test domains. |
| HOSTNAME | friday[.]stark-industries[.]solutions | Stark Industries Solutions endpoint listed among the operator’s credentialed infrastructure; the article describes the provider as bulletproof hosting used by DPRK-aligned operators. |
| HOSTNAME | vision[.]stark-industries[.]solutions | Stark Industries Solutions hosting endpoint for which the report says the operator had credentials; the article describes the provider as bulletproof hosting used for C2 infrastructure. |
| URL | hxxps[:]//gy4q3fpx3gh77gw[.]kk5yuzmev2qbgulz[.]com/#/domin/list | Funnull DNS management portal URL that the report says the operator accessed with extracted developer credentials. |
| URL | hxxps[:]//www[.]mediafire[.]com/file/gflsp6ovigjnvms/@#Full_Istaller_Pc_Setup_2024_PaSSW%E1%B9%8FrD^$.zip/file | Specific MediaFire download URL for the password-protected archive that the report identifies as containing the trojanized payload. |
MITRE ATT&CK
T1059.007 · JavaScriptThe reported supply-chain payload used injected malicious JavaScript to redirect mobile visitors.T1078 · Valid AccountsThe report says extracted credentials provided access to Funnull DNS administration, Cloudflare, Gate.us, and LR Techs accounts.T1195.002 · Compromise Software Supply ChainThe report attributes the Polyfill.io compromise to malicious changes delivered through the CDN supply chain.T1199 · Trusted RelationshipThe report says access obtained through LR Techs workspaces and accounts provided a supply-chain foothold for reaching downstream Japanese enterprise clients.T1204.002 · Malicious FileThe operator became infected after downloading and opening a trojanized, password-protected software archive.T1537 · Transfer Data to Cloud AccountThe report says the operator cloned NIMS network-blueprint documents from Google Workspace to a private drive.T1555.003 · Credentials from Web BrowsersLummaC2 extracted browser-stored credentials and other browser telemetry from the infected workstation.T1585.001 · Social Media AccountsThe report describes synthetic operator personas deployed across platforms, including LinkedIn, to secure remote work and access.
People
Threat Actors
Contagious InterviewThe article says the recovered Stark Industries Solutions credentials confirm that the operator was a member of the Contagious Interview cluster; this is the article’s attribution.LazarusThe article describes the operator’s reported crypto-laundering activity as supporting a laundering pipeline associated with Lazarus; it does not establish that the operator was a Lazarus member.
Malware
Vendors
Amazon Web ServicesPlatforms: LinkedIn, Deel, AWS, Cloudflare, GitHubCloudflareThe LummaC2 infection yielded 100+ credentials, 7,000+ browsing logs, Cloudflare admin access, and browser autofill telemetry exposing operational tradecraft.EllipticPlatforms: Sumsub, Elliptic, Outlook LiveFunnullworkstation produced definitive forensic evidence linking a North Korean stateâaligned operator to the Funnull CDN and the Polyfill.io supplyâchain attack while also revealing deep operational ties to transnationalGoogleIn a staggering display of irony, this sanctioned North Korean actor sat in on Google Meets with Western compliance vendors (Sumsub) to actively define the very AML/KYC logic designed to catch him, mapping their blindLR TechsTelemetry proves strategic espionage: the operator exfiltrated airâgapped network blueprints from NIMS and gained downstream access through LR Techs’ supplyâchain accounts.Stark Industries SolutionsTo sustain operations while evading detection, the actor relies heavily on Stark Industries Solutions.SumsubThe actor infiltrated Gate.us under the persona “Ariel Cruz,” participating in Sumsub KYC meetings to map AML/KYC blind spots and test real fugitive profiles against detection logic.
Products
CloudflareThe LummaC2 infection yielded 100+ credentials, 7,000+ browsing logs, Cloudflare admin access, and browser autofill telemetry exposing operational tradecraft.EllipticPlatforms: Sumsub, Elliptic, Outlook LiveFunnullDNSPlatforms: GitLab, FunnullDNS, Cloudflare TenantGate.usLummaC2 exfiltrated data) show the actor administered weaponized CDN infrastructure, infiltrated Gate.us KYC workflows, exfiltrated NIMS airâgapped blueprints, and operated an automated TelegramGoEdge“Brian” to hide the malicious code (the “injection function”) inside a specific build process of the “GoEdge” CDN network so that open-source users wouldn’t detect it, and actively complained when the payloadGoogle TranslateCrucially, the massive volume of Google Translate URL telemetry definitively exposes the operator’s native language and true location.Google WorkspaceIn Google Workspace (Docs/Drive), when a user clicks “Make a copy” to clone a document to their own private drive, the browser captures the title in the DOM element ID copy-filename-input.Polyfill.ioforensic evidence linking a North Korean stateâaligned operator to the Funnull CDN and the Polyfill.io supplyâchain attack while also revealing deep operational ties to transnational organized crime.SumsubThe actor infiltrated Gate.us under the persona “Ariel Cruz,” participating in Sumsub KYC meetings to map AML/KYC blind spots and test real fugitive profiles against detection logic.Telegraminfiltrated Gate.us KYC workflows, exfiltrated NIMS airâgapped blueprints, and operated an automated Telegram cryptoâlaundering gateway.
Countries
Industries
AerospaceNIMS is not just another corporate target; it is the absolute backbone of Japanese aerospace, defense, and nanotechnology research.CryptocurrencyAutomated Crypto Laundering: The actor built an automated Telegram-based cryptocurrency gateway to lease out poisoned CDN nodes and wash USDT without manual intervention.DefenseNIMS is not just another corporate target; it is the absolute backbone of Japanese aerospace, defense, and nanotechnology research.NanotechnologyNIMS is not just another corporate target; it is the absolute backbone of Japanese aerospace, defense, and nanotechnology research.