Research Maps North Korea’s Cyber Units, Revenue Operations and Support Networks

Sep 7, 2026 · Original article ↗

Summary

Kudelski Security and Sekoia analyze how North Korea organizes cyber operations across state agencies, threat clusters and overseas IT workers, using them for espionage, revenue generation and sanctions evasion.

Key points

The research describes cyber operations as part of North Korea’s strategy for regime security, intelligence gathering and revenue generation.
It says the GRIB (formerly RGB) leads offensive cyber operations, while responsibilities across agencies are frequently reorganized.
The researchers split the former Lazarus umbrella into six clusters, including groups focused on espionage, financial operations and fake IT-worker activity.
North Korean IT workers allegedly use false identities to obtain overseas technology jobs, remit earnings and exploit access for further operations.
The report describes shared infrastructure and overlapping activity between IT workers and cyber operators, as well as cryptocurrency theft and laundering methods.
Educational institutions, overseas intermediaries and front companies are described as supporting operator training, operational access and financial flows.
The researchers say DPRK activity combines espionage and revenue generation, making the distinction between those objectives less clear.

Article Details

Attack Vectors: DPRK IT workers obtain technical employment under false identities, generating revenue and gaining insider access that can support espionage or cryptocurrency theft.
Workers placed as remote consultants extend their access into client organizations and query internal corporate documentation.
DPRK-linked clusters deploy custom ransomware and ransomware-as-a-service for revenue generation.
Overseas relay networks, shared VPN exit nodes, and US-based laptop farms conceal operators' locations and support remote operations.
Historical destructive operations used wipers, including disk wiping described as an anti-forensics measure.
Defensive Notes: The researchers identify communication channels and shared VPN exit nodes as monitoring opportunities linking dispersed IT-worker units with offensive operations.
Cluster names and institutional affiliations change frequently; the article recommends tracking characteristic tradecraft, motivations, and successive reorganizations rather than relying solely on organizational labels.
The article reports overlap between financially motivated access and intelligence collection, making a strict separation between revenue-generation and espionage activity unreliable.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]214[.]44[.]138`	Exit node used by DPRK fake IT workers and listed in the annex as overlapping with Contagious Interview infrastructure.
IPV4	`167[.]88[.]61[.]117`	Exit node used by DPRK fake IT workers and listed in the annex as overlapping with Contagious Interview infrastructure.
IPV4	`185[.]135[.]76[.]89`	Exit node used by DPRK fake IT workers and listed in the annex as overlapping with Contagious Interview infrastructure.
IPV4	`188[.]43[.]33[.]252`	Exit node used by DPRK fake IT workers and listed in the annex as overlapping with Contagious Interview infrastructure.
IPV4	`211[.]211[.]6[.]181`	Exit node used by DPRK fake IT workers and listed in the annex as overlapping with Contagious Interview infrastructure.
IPV4	`23[.]237[.]102[.]130`	Exit node used by DPRK fake IT workers and listed in the annex as overlapping with Contagious Interview infrastructure.
IPV4	`37[.]120[.]154[.]98`	Exit node used by DPRK fake IT workers and listed in the annex as overlapping with Contagious Interview infrastructure.
IPV4	`38[.]75[.]137[.]97`	Exit node used by DPRK fake IT workers and listed in the annex as overlapping with Contagious Interview infrastructure.
IPV4	`45[.]86[.]208[.]162`	Exit node used by DPRK fake IT workers and listed in the annex as overlapping with Contagious Interview infrastructure.
IPV4	`50[.]7[.]159[.]34`	Exit node used by DPRK fake IT workers and listed in the annex as overlapping with Contagious Interview infrastructure.
IPV4	`66[.]118[.]255[.]35`	Exit node used by DPRK fake IT workers and linked in the annex to the Bybit attack through Silent push reporting.
IPV4	`70[.]32[.]3[.]15`	Exit node used by DPRK fake IT workers and linked in the annex to Contagious Interview reporting by Sentinel One.
IPV4	`91[.]239[.]130[.]102`	Exit node used by DPRK fake IT workers and listed in the annex as overlapping with Contagious Interview infrastructure.