Researchers Uncovered New Lazarus and Kimsuky Infrastructure with Active Tools and Tunnelling Nodes

Hunt.io and Acronis TRU uncovered a widespread North Korean (DPRK) operational infrastructure linking Lazarus and Kimsuky, revealing active tool-staging servers, credential-harvesters, FRP tunneling nodes, certificate reuse across clusters, and a new Linux Badcall backdoor variant with enhanced logging; exposed open directories and identified IP:port IOCs provide defenders actionable signals to detect and track these persistent, coordinated campaigns.