Loading story…
Researchers examining Hangro, a North Korean state-linked VPN, mail, and chat service, found a defective 2024 elliptic-curve certificate hierarchy on VPN and mail endpoints in North Korea and Russia: none of the certificates’ signatures validate, and the affected services do not appear to hold private keys corresponding to the certificates they present. Earlier testing of Hangro hosts on port 7443 found they shared a hangro.net.kp certificate issued by an apparent internal hrra2024 CA and appeared to require client certificates, preventing ordinary direct TLS connections.
Reverse engineering of an older Hangro client showed it obtains a PEM certificate locally from port 6279, decrypts an embedded private key with the password 1234, and uses GOST cryptography and token-authentication libraries. A separate RSA-based management TLS hierarchy, observed on port 6006 in July 2026, uses mutual TLS and exposes SAN entries for Hangro systems in Pyongyang and Russia’s Far East, plus an internal carrier-grade NAT address. The infrastructure and a Hangro icon on a North Korean website support the assessment that the service provides DPRK personnel and trade representatives abroad interactive access to domestic systems, potentially using Russian connectivity alongside other external routes.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
A separate RSA-4096 management certificate hierarchy issued by “KEVIN ROOT CA” appeared on port 6006. The service used mutual TLS and exposed SANs for Hangro-related North Korean and Russian addresses plus internal CGNAT address 100.100.100.170.
The two Russian Hangro hosts exposed port 6008 with a distinct malformed X.509 v1 certificate dated June 2026; North Korean hosts did not expose that port.
Hangro’s VPN and mail infrastructure used an intended four-level EC P-384 PKI hierarchy comprising HBS2024, isca2024, hrra2024, and certificates for hrpostfix, hangro.net.kp, and hrdovecot.
North Korean trade representatives in Jilin, Liaoning, and Heilongjiang were reportedly ordered to install Hangro. Distribution was handled through the DPRK consulate in Shenyang at an approximate cost of US$350 per seat.
Silibank.com historically hosted Hangro installer files in a fog/update_files directory; the directory name corresponds to the client’s Korean “fog” branding.
The Hangro icon, previously observed on ps.ppokkugi.com and described in its source as a service for visitors away from home, no longer appeared on the site around July 18.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 39 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blog.synapticsystems.de
Open sourcenkinternet.com
Open source38north.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 Labs identified a previously undocumented Linux espionage toolkit used against South Korean automotive and media organizations from at least early 2025. The toolkit includes a trojanized `HAProxy 2.8.12` build, dubbed **ted backdoor**, CurlRAT implanted in legitimate Linux daemons, a stager, and an SSH keylogger. Ted backdoor is integrated into HAProxy internals to intercept HTTP traffic, collect session material, inject scripts into selected web responses, execute commands, and suppress or evade logging. Rapid7 attributed the activity to DPRK-linked operators with medium confidence, citing infrastructure associations with **APT37**, while noting that the responsible cluster, initial-access method, and any exploited vulnerability remain unconfirmed. The operation follows broader DPRK activity against South Korean organizations, including Lazarus’s 2024–2025 SyncHole watering-hole campaign exploiting locally prevalent security and file-transfer software. Defenders should validate the integrity of HAProxy and Linux daemon binaries, hunt associated filesystem and C2 artifacts, and use independent network telemetry because compromised service logs may be unreliable.
Sep 9, 2026
FortiGuard Labs reported a high-severity cyber espionage campaign linked to North Korean state-sponsored actors that targets organizations in South Korea with phishing emails carrying malicious Windows `.lnk` files disguised as PDF documents. When opened, the shortcut launches PowerShell and other native Windows scripting tools while showing a decoy document, then performs anti-analysis checks for tools including Wireshark, Fiddler, x64dbg, Procmon, and `vmtoolsd`. Researchers said the operation has been active since at least 2024 and has evolved from earlier, less-obfuscated variants associated with XenoRAT into more sophisticated samples that embed decoding logic and payload data directly in the shortcut file. The malware establishes persistence through a Scheduled Task disguised as a technical paper and set to run every 30 minutes, then collects host data such as OS version, build number, process lists, and keep-alive logs. Operators used trusted GitHub accounts and private repositories as covert command-and-control and data-staging infrastructure, allowing malicious HTTPS traffic to blend with normal web activity while exfiltrating system information and retrieving follow-on instructions. Decoy filenames and metadata, including the "Hangul Document" naming convention, indicate deliberate targeting of South Korean companies and tradecraft aligned with clusters such as **Kimsuky**, **APT37**, and **Lazarus**.
Jun 29, 2026
North Korea-linked threat actors compromised **NPO Mashinostroyeniya**, a sanctioned Russian missile engineering and defense-industrial company, in an apparent cyberespionage operation tied to Pyongyang’s missile-development interests. SentinelLABS said the intrusion involved two separate but overlapping campaigns: a Linux email server compromise attributed to **ScarCruft** and a Windows intrusion using the Lazarus-linked **OpenCarrot** backdoor. The victim reportedly detected suspicious outbound traffic and a malicious DLL in mid-May 2022, but the full extent of the breach was not initially understood. Researchers said **OpenCarrot** enabled broad reconnaissance, process and filesystem manipulation, proxying, and multi-channel command-and-control, suggesting the attackers may have achieved wider network access. Infrastructure tied to the operation included domains such as `centos-packages[.]com` and `redhat-packages[.]com`, while later infrastructure reuse linked the activity to ScarCruft campaigns associated with **RokRAT**-style tradecraft. SentinelLABS assessed with high confidence that North Korea-affiliated operators were responsible, although it remains unclear whether **Lazarus** and **ScarCruft** shared access or were independently tasked against the same Russian target.
Jul 12, 2026