DPRK Cyber Spies Infiltrate Global Companies via Fake Job Scams, Sidestepping U.S. Sanctions

This report describes a DPRK-linked infiltration campaign that uses fake freelance IT profiles, VPNs (Astrill, Mullvad, Proton), proxy infrastructure and freelance platforms (Workana) to obtain contracts, deploy malware or exfiltrate data, and launder payments via crypto services (notably the domain luckyguys.site and IPs 163.245.219.19 and 216.158.225.144). It enumerates observable IOCs, notes an operational pivot after public exposure, and recommends hiring/site verification, SIEM rules for VPN spikes, EDR hunts, and blocking the identified infrastructure.