Stealth Tactics – Chinese APT Groups Leverage Proxies and VPNs to Conceal Operations

**Executive summary:** A recent data dump published on DDoSecrets allegedly exposed workstation files linked to a suspected North Korean APT (Kim‑suky), revealing an anonymization infrastructure that leverages Trojan proxy nodes, domain fronting/SNI tricks, and a shared SSL certificate (*.appletls.com) observed across thousands of IPs. Analysis connects commercial VPN/proxy providers (GaCloud/WgetCloud) and tooling (Txray/Xray-core) to adversary C2 and IP rotation, with intelligence firms flagging over 1,700 nodes—underscoring how legitimate anonymization services can be repurposed for sophisticated, deniable APT operations.