Inside DPRK Operations: New Lazarus and Kimsuky Infrastructure Uncovered Across Global Campaigns

This joint Hunt.io and Acronis TRU investigation maps DPRK-linked infrastructure across multiple hunts, linking Lazarus and Kimsuky activity through reused certificates, FRP tunneling, exposed open directories hosting credential-harvesters and RAT tooling, and a newly observed Linux variant of the Badcall backdoor; the report catalogs extensive IOCs and provides hunting and defender guidance to detect these recurring operational patterns.