Clik here to view.
New Russia–North Korea Road Checkpoint Takes Shape at Khasan
There’s been plenty of coverage on the bridge between North Korea and Russia that is opening soon. RFA has some great recent coverage on the progress of the bridge and security areas on both sides...
View ArticleClik here to view.
A New SiliVaccine: North Korea’s Antivirus
In 2018, Check Point published a deep dive into SiliVaccine, North Korea’s homegrown antivirus, and found its scanning engine was built on stolen, decade-old Trend Micro code. Check Point also named...
View ArticleClik here to view.
Hato Tsusin: A Long-Forgotten DPRK Front Company Hiding in Plain Sight?
In 2017, a United Nations Panel of Experts submitted a report to the UN Security Council that identified Global Communications Co. (Glocom) a Malaysian defense company as a front company for the DPRK....
View ArticleClik here to view.
Gunnersbury Avenue: Sniffing the DPRK Embassy’s WiFi
The North Korean embassy has been in the news lately, so it felt like a good time to finally write this up. A couple of weeks ago I was in London and stopped by my favorite embassy. I usually stop by...
View ArticleClik here to view.
DPRK Captive Portal Infrastructure Found in Testing
Taking a break from fake DPRK companies for a while, there was some interesting activity that I recently noticed on 175.45.176.97. Between May 14th and May 17th, 175.45.176.97 a request to the root of...
View ArticleClik here to view.
More Fake Devs, More Fake Companies: vexxloso and Nixsora.com
If you haven’t read part 1, you can read it here: https://nkinternet.com/2026/04/07/npm-malware-fake-devs-and-deepfake-videos-these-are-a-few-of-my-favorite-dprk-things/ In order to keep the first...
View ArticleClik here to view.
npm Malware, Fake Devs, and Deepfake Videos: These Are A Few of My Favorite...
What started as what I thought was going to be a quick look into a suspicious GitHub organization turned into a much deeper rabbit hole with an active npm backdoor, more than a dozen fake developer...
View ArticleClik here to view.
Made for Export: North Korea’s Software Catalog
An email discovered last year that was sent from North Korea’s internet infrastructure offers a rare look at how DPRK software developers market their work abroad. While most recent reporting has...
View ArticleKwangmyong
Over the years I’ve come across a number of sources and log files that provides some insight into what is on North Korea’s Kwangmyong. If you’re not familiar, North Korea has an intranet inside the...
View ArticleClik here to view.
Additional Notes on the Trevor Greer Infostealer Logs
A recent post by Hudson Rock detailed information derived from infostealer logs tied to activity associated with the Trevor Greer persona, you know the one trevorgreer9312@gmail[.]com. That write up...
View ArticleClik here to view.
Hunting For North Korean Fiber Optic Cables
Before we go any further, one thing that I want to make clear is that the word assume is going to be doing some heavy lifting throughout this post. This was a rabbit hole that I recently went down and...
View ArticleClik here to view.
Hangro: Investigating North Korean VPN Infrastructure Part 2
If you haven’t seen part 1, it provides an overview of the service as well as the domains and IPs supporting the infrastructure. Continuing my analysis of the Hangro VPN IPs and service I started...
View ArticleClik here to view.
What We Discovered On a North Korean Server Part 1
Last year we discovered a North Korean server that was hosting numerous animation files. I wanted to share a more detailed write-up about how we discovered the server, as well as some more details...
View ArticleClik here to view.
Finding North Korean IT Workers On GitHub
It’s not really a secret that North Korean IT workers are using GitHub for a number of reasons. While there are several posts that cover different clusters of users as well as why they are using...
View ArticleClik here to view.
North Korea Offline With Invalid Routes for AS131279
On March 18, 2025, at around 9:38 AM UTC, connectivity to AS131279 dropped. Shortly after, at 9:50 AM UTC, a change in the Start of Authority (SOA) record and an update to the Route Origin...
View ArticleClik here to view.
Clik here to view.
Manbang Set Top Box Manual
A short post since 38North has a much longer write up about the Manbang set top box here: https://www.38north.org/2019/02/mwilliams022219/ But I recently came across the manual to the Manbang set top...
View ArticleClik here to view.
Hangro: Investigating North Korean VPN Infrastructure Part 1
In a post from a now-deleted user on the webdev subreddit, someone asked about how to acquire a .kp TLD. While there were a few decent responses, the original poster shared an update: they...
View ArticleClik here to view.
Inspecting North Korea’s Digital Map App: Licensing & API Insights
I’ve been meaning to write this for a while but it turned into a much longer write up than I was expecting so it’s being broken into multiple parts. Martyn at 38 North did a great write up on the app...
View ArticleClik here to view.
Investigating korfilm.com.kp DNS Errors
There’s an interesting DNS misconfiguration for korfilm.com.kp, the website for the Korea Film Export & Import Corporation. It appears that someone made a typo when configuring the DNS records...
View Article
![VA - Give Me Disco - Vol 2 (Selected by DJ Kobayashi) (2026) [Hi-Res]](http://www.dibpic.com/uploads/posts/2026-10/1790963100_cover.jpg)
![Mac Miller – The Divine Feminine (10th Anniversary) [iTunes Plus M4A]](http://is1-ssl.mzstatic.com/image/thumb/Music211/v4/a5/f7/d9/a5f7d909-56a4-813b-15ce-fc50e32afb7d/093624817154.jpg/296x296bb.webp)
