Shadows of the North: Unmasking the Sprawling Cyber Infrastructure of the DPRK

A new collaborative investigation has exposed the intricate and overlapping infrastructure powering North Korea’s most notorious cyber operations, with researchers from Hunt[.]io and the Acronis Threat Research Unit mapping the operational backbone of the DPRK as of 22 December 2025.

The joint report reveals a complex ecosystem where espionage, financial theft, and destructive activities collide, and shows that threat groups like Lazarus, Kimsuky, and Bluenoroff share a unified, utilitarian logistical web rather than existing as completely separate entities.

Groups such as Lazarus, Kimsuky, and other subgroups run their own playbooks—spanning espionage, financial operations and destructive activities—yet they often share toolkits and rely on similar infrastructure patterns and delivery lures, according to the report. The investigation focused on the servers and networks that sustain operations, surfacing clusters of operational assets that had not been connected publicly before.

Key findings include active tool-staging servers, credential theft environments, FRP tunneling nodes and certificate-linked infrastructure, which together illustrate how DPRK actors intersect across campaigns and hinder defenders’ visibility.