Researchers Map Evolving Network Infrastructure of DPRK Fake IT Workers

Jul 17, 2026 · Original article ↗

Summary

Kudelski Security uses public data and stealer logs to map changes in DPRK fake IT worker infrastructure, identify VPN exit nodes and internal network clusters, and assess possible organizational links with varying levels of confidence.

Key points

The research is based on passive analysis of publicly available data, including stealer logs; some infrastructure attribution and organizational links remain uncertain.
Researchers observed changes to public-facing infrastructure and traced an apparent route from North Korea to western Russia.
Fake IT workers appear to use commercial VPNs for exit nodes in the United States and Japan; researchers also identified overlap between some exit nodes and offensive teams.
The report describes differences in how two clusters conceal their public IP addresses and notes high volumes of DNS requests through MikroTik routers.
Private-network findings link team names and infrastructure to entities including Ryonbong and Kim Chaek University of Technology, though the researchers say some structures and purposes remain unresolved.
Researchers added a cluster labeled PUG to the offensive infrastructure, but its location and purpose are unknown.

Article Details

Attack Vectors: DPRK fake IT workers use commercial VPN services to obtain exit nodes in the United States and Japan, which researchers used as a pivot for analyzing stealer logs.
The report identifies infrastructure used for command-and-control operations, including a high volume of DNS requests sent through MikroTik routers.
A stealer log showed an operator configuring a Huawei HiLink router and accessing it at 192.168.8[.]1 on a network associated with Team 313.
Internal communications reportedly used a WebRTC call server and a separate tool called CallPC.
Defensive Notes: Researchers can use IP addresses associated with previously observed campaigns as pivot points in OTX to identify potential infrastructure overlaps.
The report notes that Cluster A appears to take greater care to conceal C2 source IPs, while Cluster B reuses some public IP addresses with less concealment.

Indicators of compromise

Type	Indicator	Context
IPV4	`104[.]253[.]160[.]77`	Listed in the report's DPRK fake IT worker infrastructure IOC section.
IPV4	`104[.]253[.]201[.]228`	Listed in the report's DPRK fake IT worker infrastructure IOC section.
IPV4	`104[.]253[.]43[.]239`	Listed in the report's DPRK fake IT worker infrastructure IOC section.
IPV4	`104[.]253[.]7[.]202`	Listed as infrastructure associated with Polaris Team.
IPV4	`104[.]253[.]75[.]110`	Listed in the report's DPRK fake IT worker infrastructure IOC section.
IPV4	`162[.]253[.]129[.]2`	Listed as infrastructure associated with the MyoHyangGyongSong team.
IPV4	`175[.]45[.]176[.]144`	Listed among DPRK fake IT worker exit-node infrastructure.
IPV4	`175[.]45[.]176[.]160`	Listed among DPRK fake IT worker exit-node infrastructure.
IPV4	`175[.]45[.]176[.]180`	Listed among DPRK fake IT worker exit-node infrastructure.
IPV4	`175[.]45[.]176[.]27`	Listed as supporting DPRK C2 operations.
IPV4	`175[.]45[.]176[.]40`	Listed among DPRK fake IT worker exit-node infrastructure.
IPV4	`175[.]45[.]176[.]69`	Listed among DPRK fake IT worker exit-node infrastructure.
IPV4	`175[.]45[.]178[.]222`	Identified as a DPRK attacker exit node; the report says it has been attributed to an attacker team for more than five years and is reused in C2-related infrastructure.
IPV4	`91[.]239[.]130[.]102`	Listed as infrastructure associated with Team 128-710.
URL	`hxxp[:]//192[.]168[.]109[.]2/call`	Internal WebRTC call-server URL identified on the RB proxy network and linked by the researchers to actors' internal communications.