Researchers Link Naver Phishing Infrastructure and Apple Spoofing Domains to Suspected DPRK Activity
Summary
Researchers found an exposed server hosting incomplete Naver credential-phishing pages and a separate cluster of Apple-spoofing domains. Infrastructure and certificate patterns are consistent with DPRK-linked activity, but attribution is unconfirmed.
Key points
- An exposed directory on a Seoul-hosted server contained folders and pages designed to mimic Naver account and password-change flows.
- The phishing pages appeared incomplete: the credential fields did not function, and the PHP scripts returned blank pages.
- Logs in the server’s directories contained IP addresses that researchers said could indicate tracking of visitors, potential victims, or researchers.
- More than 200 domains resolved to the server; many used low-cost domains and frequently replaced Let's Encrypt certificates.
- A separate cluster used Apple-themed domains and shared certificates across multiple IPs and countries; a researcher linked one IP to Talos activity tracked as UAT-5394.
- The researchers said the findings are consistent with DPRK-linked tactics, but attribution to a specific group or actor is not confirmed.
Article Details
- Attack Vectors
- Credential-phishing pages imitating Naver, including a fake password-change page intended to prompt users to provide credentials.
- Apple-themed domain and certificate spoofing, including typosquatting and certificate rotation across multiple IP addresses.
- HTTP redirects from suspicious infrastructure to Naver pages; the article describes the phishing pages as incomplete and does not confirm credential exfiltration.
- Defensive Notes
- Monitor for the listed suspicious IP addresses, domains, and certificate SHA-256 fingerprints, including infrastructure that shares certificates or certificate common names.
- Treat the reported attribution to DPRK-linked activity as unconfirmed; the article describes the Naver campaign and Apple-spoofing cluster as separate infrastructures.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | applelplus1[.]hydadhybidad2[.]xyz | Domain observed as a certificate common name on 185.239.0[.]43; the article says its connection to the current activity is unconfirmed. |
| DOMAIN | appleplus[.]dnbaletmigardam[.]top | Apple-impersonating certificate common name observed on a host in the reported cluster. |
| DOMAIN | appleplus[.]sbs | Apple-impersonating domain listed on a host in the reported cluster. |
| DOMAIN | appleplus[.]shop | Apple-impersonating domain observed in certificates across the reported suspicious infrastructure cluster. |
| DOMAIN | ecolekoenig[.]top | Domain listed on a host associated with the suspicious Apple-impersonating certificate cluster. |
| DOMAIN | file-explorer-aerocenter[.]org | Domain listed on a host associated with the suspicious Apple-impersonating certificate cluster. |
| DOMAIN | gyvan3-ppfhg[.]link | Domain listed on a host associated with the suspicious Apple-impersonating certificate cluster. |
| DOMAIN | hostingnhisserver[.]store | Domain listed as directly linked to the server hosting the suspected phishing directory. |
| DOMAIN | nextonlinecom[.]store | Suspicious domain observed in the referer field during analysis of the reported phishing flow. |
| DOMAIN | schulen-horw[.]com | Domain listed on a host associated with the suspicious Apple-impersonating certificate cluster. |
| DOMAIN | shelby-cp-ecole[.]org | Domain listed on a host associated with the suspicious Apple-impersonating certificate cluster. |
| DOMAIN | tarifaconcursodeacreedores[.]top | Domain listed on a host associated with the suspicious Apple-impersonating certificate cluster. |
| DOMAIN | topseven[.]top | Domain listed on a host associated with the suspicious Apple-impersonating certificate cluster. |
| DOMAIN | ulta[.]appleplus[.]store | Apple-impersonating domain identified as part of the suspicious certificate and infrastructure cluster. |
| DOMAIN | vinetro[.]info | Domain listed on a host associated with the suspicious Apple-impersonating certificate cluster. |
| DOMAIN | visitnhisserver[.]store | Suspicious domain serving a customized Naver-themed page in the reported phishing flow. |
| DOMAIN | westwindmotorinn[.]xyz | Domain listed on a host associated with the suspicious Apple-impersonating certificate cluster. |
| DOMAIN | wrightechltd[.]link | Domain listed on a host associated with the suspicious Apple-impersonating certificate cluster. |
| DOMAIN | yarzzk[.]link | Domain listed on a host associated with the suspicious Apple-impersonating certificate cluster. |
| IPV4 | 107[.]189[.]16[.]65 | Host associated with the suspicious Apple-impersonating certificate cluster. |
| IPV4 | 158[.]247[.]238[.]155 | Server hosting the exposed directory and domains associated with the suspected phishing operation. |
| IPV4 | 159[.]253[.]4[.]64 | Host listed among the IPs associated with the suspicious Apple-impersonating infrastructure. |
| IPV4 | 159[.]253[.]4[.]70 | Host listed among the IPs associated with the suspicious Apple-impersonating infrastructure. |
| IPV4 | 185[.]239[.]0[.]39 | Host identified in the reported Apple-impersonating certificate and infrastructure cluster. |
| IPV4 | 185[.]239[.]0[.]42 | Host associated with the Apple-impersonating domain ulta.appleplus[.]store. |
| IPV4 | 185[.]239[.]0[.]43 | Host listed in the Apple domain-spoofing observables. |
| IPV4 | 185[.]239[.]2[.]170 | Host identified in the reported Apple-impersonating certificate and infrastructure cluster. |
| IPV4 | 192[.]121[.]17[.]63 | Host listed among the IPs associated with the suspicious Apple-impersonating infrastructure. |
| IPV4 | 206[.]206[.]125[.]237 | Host associated with Apple-impersonating certificate common names in the reported cluster. |
| IPV4 | 84[.]32[.]186[.]252 | Host listed among the IPs sharing the suspicious Apple-impersonating certificate or domain indicators. |
| SHA256 | 3201fa0f5d8269e556aec50f820f17e1ae760cd86e5084bdccdfe0aff6430e06 | SHA-256 fingerprint of a short-lived certificate associated with the Apple-impersonating infrastructure. |
| SHA256 | 35a101941f438a7d072b31eb3b666e2c31a070dd7cf8099d20b738778fbd3458 | SHA-256 fingerprint of a frequently updated certificate observed on the suspicious phishing server. |
| URL | hxxps[:]//158[.]247[.]238[.]155/naver | Exposed directory containing files associated with the suspected Naver phishing operation. |
| URL | hxxps[:]//visitnhisserver[.]store/success[.]html | Specific Naver-themed page served by suspicious infrastructure in the reported phishing flow. |
People
Threat Actors
KimsukyMentioned as a group associated with exposed phishing servers and as a possible link; attribution in this article is not definitive.LazarusMentioned as a group with a history of focusing on South Korean entities; the article does not definitively attribute the reported activity to it.UAT-5394A researcher reportedly linked one IP in the separate Apple-spoofing cluster to Talos' UAT-5394; the article describes the connection as related threat activity.
Products
AppleSeparately, an unrelated infrastructure cluster was found using domains and certificates that impersonated Apple. Both findings align with tactics commonly linked to cyber operations by Democratic People's Republic ofNaverresearchers recently uncovered evidence of a suspected North Korean-linked phishing campaign targeting Naver, a major South Korean tech platform. The initial discovery involved an open directory containing phishing