North Korean Hackers Expose Their Playbook for Swapping Infrastructure

A sophisticated North Korean cyber operation has been exposed, revealing how state-sponsored hackers monitor cybersecurity intelligence platforms to detect when their infrastructure is discovered and rapidly deploy replacement assets to maintain operations. The analysis, according to SentinelLABS in collaboration with Validin, shows threat actors operate in coordinated teams with real-time collaboration, likely using platforms such as Slack alongside multiple intelligence sources.

Despite awareness that their infrastructure is detectable, the actors make only limited changes to reduce detection risk while rapidly deploying new infrastructure in response to service provider takedowns. They appear to prioritise maintaining operational readiness and sustaining high victim engagement over protecting existing assets, with the Contagious Interview campaign primarily targeting cryptocurrency and blockchain professionals using social‑engineering techniques known as ClickFix.

Between January and March 2025, SentinelLABS identified over 230 victims engaging with fraudulent employment offers, with victims largely in marketing and finance roles within cryptocurrency companies. The campaign impersonates legitimate firms such as Archblock, Robinhood, and eToro to lure victims, and nodes such as ContagiousDrop tools log victim information and notify threat actors via email.