Hunting Lazarus Part VII: The Server That Was Not Just FTP

This is Part VII of the "Hunting Lazarus" series. The earlier installments documented the Contagious Interview campaign run by Lazarus Group – the DPRK-linked APT – which targets cryptocurrency and Web3 developers with fake job interviews, fabricated company identities, and malicious code repositories. Part VI described an operation that ran its own pipeline across its own machines and harvested its own people in the process. This installment names one of the machines that pipeline kept using.

The FTP exfiltration sink was port 21. The rest of the host told a larger story.

Executive Summary

Red Asgard's investigation of the Hetzner host at 1…