Acronis TRU Alliance {Hunt.io}: Hunting DPRK threats - New Global Lazarus & Kimsuky campaigns

This report documents a multi-hunt investigation linking DPRK threat actors (Lazarus, Kimsuky) through infrastructure artifacts: a new Linux Badcall backdoor variant, widespread FRP tunneling instances, exposed open directories hosting credential-harvesting and RAT tooling, and certificate-linked RDP/TLS clusters; it provides IOCs and defender hunting guidance to track these persistent, scriptable operational patterns.