Inside the DPRK Fake IT Workers Network: IP Ranges, Proxies, and Internal Coordination

This report analyzes a leaked mail dump and stealer logs attributed to DPRK IT workers and reconstructs their internal infrastructure: public and private IP ranges and proxies (including residential/proxy services), squid proxy usage, internal HTTP endpoints for user/machine reporting, and internal IP-messenger chat excerpts and naming conventions; it supplies multiple IOCs and operational observations to support attribution and defensive action.